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FOREWORD 


AIDS has presented a host of unanticipated 
and unwanted challenges to the global com- 
munity. Scientists, physicians, legislators, 
ethicists and lawyers are grappling with these 
challenges, often with little or no precedent 
to guide them. Compounding this difficulty 
is the aura of fear surrounding the syndrome, 
and the consequential danger of discrimina- 
tion against those tainted by even a remote 
association with AIDS. 


Among the AIDS-related issues being thrust 
upon society are those relating to privacy. 
Public reactions to this lethal syndrome are 
anything but predictable. Some reactions are 
extreme -- refusals to let lodgings to an in- 
fected person, refusals to work in the same 
office and refusals to provide basic public 
services, such as education, ambulance, fire 
and police services and hospital care. HIV 


infected persons may see their travel to 


foreign countries restricted. Disclosure of 
their infection may lead to criticism of their 
perceived lifestyle. Unnecessary publicity 
may (some Say will) cause an infected person 
immense trauma beyond that caused by living 
with the infection itself. 


The unpredictability of the public (and 
government) reaction to AIDS creates a com- 
pelling need to examine the privacy interests 
associated with the syndrome. Few among us 
might object to others knowing that we have 
a common cold. We might criticize the col- 
lection of this information by government as 
being intrusive. We would, however, face 
little prospect of discrimination. Yet how 
many among us would remain as uncon- 
cerned if information were released identify- 
ing us as carriers of the HIV -- the virus that 
causes AIDS? 


This report examines the implications of the 
Privacy Act for the federal government’s col- 
lection, use and disclosure of "AIDS-related 
personal information". Our concern is to en- 
sure to the extent possible that individual 
privacy is not trampled as we seek to head off 
the AIDS epidemic in Canada. In the lan- 
guage of the Privacy Act, our concern is to 
identify what personal information should be 
collected, used and disclosed to prevent the 
further spread of HIV infection in Canada. 
The conflicting faces of the issue are immedi- 
ately apparent. 


The Privacy Act seeks to protect individuals 
from federal government institutions which, 
without sufficient cause, may want to snoop 
into their affairs and amass information about 
them. Nowhere are the dangers of amassing 
personal information more real than in the 
context of AIDS-related personal informa- 
tion. 


The collection of this information is itself 
intrusive; at present it requires the taking of 
a person’s blood. The uses of this informa- 
tion are manifold -- and not all benefit the 
individual affected or, indeed, the public. 
The consequences of disclosure can be 
dramatic. They have the potential to alter the 
very conditions of membership in society. 


While the Privacy Commissioner of Canada 
is mandated to ensure that the rights which 
the Privacy Act gives every Canadian are 
preserved, notably the protection against un- 
warranted government prying into personal 
information, privacy sometimes must give 
way to other social goods. In particular, 
privacy must be balanced against the need to 
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permit the collection, use and disclosure of 
personal information as part of an effective 
public health response to AIDS. 


This report assesses the collection, use and 
disclosure of AIDS-related personal infor- 
mation by federal institutions. The collection, 
use and disclosure of this information by 
other institutions (local boards of health, for 
example) largely falls outside the mandate of 
the Privacy Act. Accordingly, the issues ad- 
dressed in this report concern only one facet 
of the privacy issues relating to AIDS -- the 
federal government response. 


The study begins by defining the nature of 
AIDS-related personal information. The 
appendices provide a glimpse into the nature 
of the syndrome known as AIDS, its 
dynamics, and how it has affected and will 
probably affect Canada over the next several 
years. They also examine federal legislation 
that, along with the Privacy Act, controls the 
collection, use and disclosure of personal in- 
formation by government institutions. Final- 
ly, there is a discussion in the appendices of 
the present treatment of AIDS-related per- 
sonal information by several "front-line" 
federal government institutions. 


The heart of this report -- Parts IJ and IV -- 
offers recommendations on how to treat 
AIDS-related personal information to con- 
form with the requirements of the Privacy 
Act. It also examines the practical applica- 
tion of these recommendations to personal 
information about government employees, 
clients (such as unemployment insurance 
recipients or immigrants) and the general 
public. 


A basic theme of this report is that of caution: 
caution in the collection of AIDS-related per- 
sonal information, caution in its use and cau- 
tion in its disclosure. The clear, even 
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self-evident, perception of the need for such 
caution in handling this delicate information 
has persuaded us to recommend "sup- 
plementing", insome cases, the strict require- 
ments of the Privacy Act with additional 
measures. In short, the extreme sensitivity of 
AIDS-related personal information warrants 
protection beyond that provided by the Act 
alone. 


The situation calling for this extreme caution 
may change. Disclosure of AIDS-related 
personal information may one day not 
threaten the physical and psychological well- 
being of those affected by the disclosure (as 
has happened with other diseases, notably 
cancer), nor drastically alter the conditions of 
their membership in Canadian society. But 
for now, the strong possibility exists that 
public, and even government, opinion and 
actions could harm those individuals whose 
personal information is disclosed -- without 
providing any measurable benefit to society. 


This report also emphasizes the need for the 
federal government, specifically the Treasury 
Board, to provide leadership to government 
institutions which will increasingly face 
AIDS-related issues. The role of Treasury 
Board as the public service employer makes 
it the most desirable centre for the develop- 
ment of a government-wide policy on AIDS 
in the public service. 


To hope for an early cure or an effective 
vaccine is a natural human response to this 
terrible disease. But hoping does not 
diminish society’s responsibilities today. The 
principles set forth here in responding to the 
privacy issues in handling the personal infor- 
mation of those affected by HIV infection 
and AIDS may not give much long-term com- 
fort. But at least they make society’s response 
more humane. For the moment, perhaps that 
is the best we can do. 
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(a) General 


AIDS-related afflictions have killed more 
than 1200 Canadians. In the absence of a 
cure, they will kill thousands more over the 
next several years. Once a person develops 
AIDS (as opposed to merely carrying the 
virus that causes AIDS), death is certain. 


Rough, and perhaps ultimately unreliable, 
estimates suggest that approximately 50,000 
Canadians carry the virus that can cause 
AIDS. The most pessimistic view is that, 
without a cure, all these infected people will 
eventually develop AIDS and die 
prematurely. 


Governments around the world have begun 
to assume responsibility for protecting their 
citizens from contracting AIDS. Measures 
have included the following: 


e educating the public about how to avoid 
AIDS (for example, reducing high-risk 
behaviour) and 


e testing selected groups or the general 
population for the presence of the virus 
that causes AIDS and (a) isolating in- 
fected persons, (b) publicly identifying 
infected persons to warn others, (c) ad- 
vising infected persons not to engage in 
"high-risk" activities with uninfected 
persons, (d) applying sanctions to those 
who knowingly expose others to the 
virus or (e) some combination of the 
above. 


The proper extent and mix of these efforts in 
defining a Canadian AIDS strategy is a sub- 
ject of ongoing debate. In part, the debate is 
concerned with whether there should be an 
obligation to take a test for the presence of 
the antibody to the virus that causes AIDS -- 
the HIV (human immunodeficiency virus). If 
so, what, if anything, should be done to iden- 
tify, either publicly or to a smaller group, 
those who are infected? So far, there are no 
clear answers. 


At the heart of the debate is the perennially 
problematic search for a balance between 
individual rights and the public good. In- 
dividual privacy is one important right at 
stake. 


This report seeks to elaborate a Canadian 
privacy strategy which strikes a balance be- 
tween the public good and the rights to the 
protection of personal information set out in 
the Privacy Act. It makes recommendations 
for the collection, use and disclosure of 
AIDS-related personal information by 
federal government institutions. 


"AIDS-related personal information" can be 
understood as information about an identifi- 
able person that may indicate any of the fol- 
lowing: 


e that the person has AIDS or any AIDS- 
related illness 


e that the person has been advised or re- 


quired to take an HIV antibody test or 
other associated test 
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e that the person has taken tests for the 
presence of the HIV antibody or has 
taken tests that may be associated with a 
diagnosis of HIV infection or AIDS 


e that the person has refused to be tested 
e that the person has asked to be tested 


e that the person has been counselled by 
a health care professional about the 
HIV antibody test before or after taking 
a test, or 


e the results of the test or tests. 


The collection, use and disclosure of AIDS- 
related personal information concerns per- 
sons as individuals and as members of groups 
in society. Individuals may be employees of 
a government institution -- for example, 
members of the RCMP or Canadian Forces, 
foreign service personnel or corrections of- 
ficers. They may be "clients" of government, 
such as inmates in federal penitentiaries, ap- 
plicants for unemployment insurance, or im- 
migrants. They may also be members of the 
general public. 


The report reviews the present and possible 
future treatment of AIDS-related informa- 
tion by several federal government institu- 
tions. It also discusses present and planned 
actions by several institutions about the col- 
lection, use and disclosure of AIDS-related 
personal information. 


The focus of this report is narrow. It cannot 
attempt to address the explosion of legal, 
medical and ethical issues that have arisen 
since AIDS entered daily vocabulary. It ex- 
amines some of these issues, but only as they 
relate to privacy concerns. 
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CAUTION: Knowledge about AIDS is in its 
infancy, as are AIDS research and under- 
standing. The syndrome was identified only 
in 1981. Findings about AIDS may affect the 
issues discussed in this report and the op- 
tions for dealing with those issues. The dis- 
covery of a vaccine to protect against HIV 
infection or AIDS, or the discovery of new 
mechanisms of transmission, for example, 
could create new issues under the Privacy Act. 
This report will discuss some possible 
developments and their impact on privacy 
considerations; it cannot predict every one. 
Accordingly, the reader must remember 
when reviewing this document that changing 
scientific knowledge, changes in treatment, 
changes in the way HIV infection spreads or 
changes in the rate of spread may affect the 
issues and their resolution. 


Some background information on the nature 
of AIDS may assist the reader to analyze the 
issues that form the focus of this report. Ap- 
pendix I discusses several technical aspects of 
AIDS: the nature of the syndrome, methods 
of transmitting the HIV, international and 
Canadian statistics on the spread of AIDS, 
projections on the future number of AIDS 
cases in Canada, regional variations in 
Canada and the direct and indirect costs as- 
sociated with AIDS. 


(b) Testing’ 


The human immunodeficiency virus (HIV) 
causes AIDS. Current medical tests for 
AIDS do not focus on HIV. Instead, current 
tests detect antibodies to HIV. Antibodies 
are proteins produced by the body in 
response to an invasion of foreign substances, 
such as viruses, bacteria, or even pollen 
grains. 


Various antibody tests are used in Canada. 
All use samples of blood to detect the 
presence of the antibody to HIV. 


To test properly, a series of tests may be 
necessary. The first is known as the ELISA 
screening test. If the test produces a "nega- 
tive" result (that is, the test shows no an- 
tibodies to the HIV), no further tests are 
performed. The person who provided the 
blood sample is generally assumed not to 
have been infected with the HIV (but see 
discussion of "false negatives" below). 


The ELISA screening test may produce a 
"positive" result. This gives a preliminary in- 
dication that the person has déveloped an- 
tibodies to the HIV. In other words, he or she 
is thought to be infected with the HIV. If so, 
a second ELISA test is performed. Then, 
regardless of result, a more accurate "confir- 
matory" test is performed. The confirmatory 
test may be any one of three such tests now 
used in Canada. 


The Federal Centre for AIDS reports that 
using one ELISA screening test in low risk 
populations may result in as many as 12 false 
positive results for every one truly positive 
result. A false positive means that a person is 
wrongly diagnosed as having been infected 
with the HIV. It is therefore essential not to 
conclude that a person is infected solely on 
the basis of a screening test. Confirmatory 
testing can correct false positives in the vast 
majority of cases. 


Provincial laboratories perform virtually all 
screening and confirmatory tests that are car- 
ried out in Canada. The Federal Centre for 
AIDS Retrovirus Laboratory provides a ref- 
erence laboratory for the provinces to help 
decide difficult cases. 
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The Meaning of a Positive Test Result: A 
positive HIV antibody test result (also called 
HIV "seropositivity") indicates the presence 
of antibodies to the virus. It is only indirect 
evidence of infection; it does not identify the 
presence of the virus itself. Seropositivity 
means that a person has been exposed to the 
HIV and has developed antibodies to it. It is 
now accepted that a "confirmed" positive test 
means the following: 


e that the development of antibodies 
generally indicates the continuing 
presence of the virus in the body; 


e that infection with the virus is probably 
lifelong, and 


e thata person with antibodies is probably 
capable of transmitting the HIV to 
others. 


The Meaning of a Negative Test Result: A 
negative antibody test result (HIV 
"seronegativity") generally means that a per- 
son has developed no antibodies to the HIV 
because the person has not been exposed to 
the HIV. It may also mean that the person 
has been exposed to the HIV but has not 
become infected. No antibodies are there- 
fore produced and there is no danger of trans- 
mission of the HIV because it has not reached 
or remained in the person’s body. A negative 
test, however, may sometimes be false, for the 
following reasons: 


e antibodies normally take four to six 
weeks to develop after infection with the 
HIV. In some cases, it may take several 
months. A test taken before antibodies 
have developed will show a negative 
result, even though the person has been 
exposed to the HIV and is infected; 
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e some persons infected with HIV may 
never develop antibodies to the HIV, 
even though they have become infected. 
Some recent medical and scientific 
opinion supports this possibility; 


e the test is not sufficiently sensitive to 
detect antibodies in everyone; 


e rarely, some people lose antibodies to 
the HIV during the course of their HIV 
infection, although they probably 
remain infectious or infected, or both; 


e the test was performed by inexperienced 
testing personnel or it was not properly 
administered. 


If a properly tested person tests positive, he 
or she generally remains positive for life. It 
would be dangerous to make the same as- 
sumption about a "true negative" result. Even 
if a person is now uninfected, he or she may 
not remain so. The person may, for example, 
subsequently become infected through con- 
tact with an infected person, by injecting 
drugs with an HIV-contaminated needle or 
by accidental exposure to infected blood. To 
be even reasonably certain of continuing true 
negativity, it is therefore necessary to conduct 
repeat testing. Even then, that testing must 
take place sufficiently long after the in- 
dividual encountered the virus to permit an- 
tibodies to develop. And, as explained above, 
other deficiencies in assessing seronegativity 
remain. 


A negative test result therefore does not pro- 
vide the same level of confidence as a true 
(confirmed) positive test result. It is impor- 
tant to recognize these limitations of negative 
test results. Any decision that turns on nega- 
tive test results must take this into account. 
Accepting negative test results categorically 
is little short of negligent. 
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ENDNOTES TO PART I 


1. This information was drawn largely from 
draft materials supplied by Joel Finlay of the 
Federal Centre for AIDS. 
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PART II 


CONCERNS ABOUT THE COLLECTION, USE AND DISCLOSURE OF 
AIDS-RELATED PERSONAL INFORMATION 


Scientific information about the nature of 
AIDS and statistics on AIDS are not likely to 
affect the privacy of an individual. This infor- 
mation is therefore not "sensitive" from a 
privacy standpoint. 


Information that can be linked to an in- 
dividual, however, is almost certainly sensi- 
tive. That information may include the 
medical condition, social contacts, sexual 
habits or other characteristics of a person. It 
may in fact include all that we have defined in 
Part I as "AIDS-related personal informa- 
tion’. 


(a) The Case Against 
Collection, Use and 
Disclosure 


Experience with AIDS over the last seven 
years has identified a host of problems flow- 
ing from the collection, use and disclosure of 
AIDS-related personal information. Most 
take the form of discrimination. 


In Canada, AIDS is closely associated with 
homosexual or bisexual behaviour. The 
Federal Centre for AIDS has received 
reports of 2323 cases of AIDS as of January 
3, 1989. By far the largest number (2166) 
occurred in adult males. The principal risk 
factor for AIDS in adult males was 
homosexual or bisexual activity (86 per cent 
of adult male cases). Just over three per cent 
involved both intravenous drug use and 
homosexual or bisexual activity. 
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Having AIDS, or testing HIV seropositive, 
may therefore be enough evidence for others 
to conclude that a male is homosexual or 
bisexual, and to discriminate on that basis. 


Discrimination may be based both on the 
perceived lifestyle of the person and on the 
fear of contagion. And anti-discrimination 
legislation may not provide the strong protec- 
tion needed to deter discrimination borne of 
misunderstanding and overwhelming fear. 


AIDS-related discrimination is not a 
hypothetical concern. It is real. The 
Canadian Human Rights Commission 
(CHRC) is currently investigating two com- 
plaints from men who say they lost their jobs 
because they were infected with HIV. 


In a May 1988 policy statement the CHRC 
acknowledged that discrimination could 
result from public knowledge that a person is 
infected with the HIV. It may also occur, the 
CHRC said, against an uninfected person 
who associates with an infected person, or 
against an uninfected person who belongs to 
a group associated with a high rate of HIV 
infection (homosexuals, Haitians or 
hemophiliacs, for example). Accordingly, 
the CHRC will now permit these latter 
groups, as well as infected persons, to bring 
complaints of discrimination to the CHRC. 


Even being tested for the presence of HIV 
antibodies, refusing to be tested, or being 
advised to be tested may provide enough 
"evidence" for others to conclude that a per- 
son is infected or is engaged in high risk ac- 


tivities and to discriminate on those bases. 
Accordingly, a wide range of AIDS-related 
personal information should be protected to 
avoid such inferences. 


Having AIDS-related personal information 
widely collected, used and disclosed can have 
several practical consequences:' 


(a) loss of employment: When AIDS- 
related personal information becomes 
known to an employer or fellow 
workers, or those whom the employee or 
employer serve, the employee risks dis- 
missal. Ample numbers of cases have 
illustrated that even asymptomatic in- 
fected persons risk losing employment -- 
human rights codes notwithstanding -- 
when their condition becomes known. 
The dismissal may be based on fear of 
contagion or loss of business, or result 
from discrimination based on the per- 
ceived homosexual lifestyle of the per- 
Son; 


Given that many employers provide 
health care plans for their employees, 
the loss of employment can be doubly 
serious. An infected person who 
develops AIDS may face crippling bills 
for drugs and dental care (hospitaliza- 
tion will still be provided by provincial 
authorities). 


(b) loss of friends and family: Among 
the most traumatic experiences iden- 
tified by infected persons or those 
thought to be infected is the social isola- 
tion they may experience when their 
condition becomes known. Friends and 
family may forsake them. Again, this 
may be due to fear of contagion or be- 
cause a male’s homosexuality surfaces 
or is inferred. 


AIDS and the Privacy Act 


(c) alienation from the community: 
Families of infected persons can be 
driven from their communities because 
a family member is known or thought to 
be infected. Community attitudes can 
border on paranoia. However irrational 
this response, it must be acknowledged 
as a possible consequence of disclosure. 


Even if the community does not react in 
a hostile or irrational fashion today, 
there is no guarantee that this 
benevolence (or apathy) will continue. 
New medical findings about AIDS, or a 
shift in community attitudes, could cre- 
ate an impossibly hostile climate for 
those thought to be infected. The 
potential for this shift is heightened by 
the association of the disease with un- 
popular lifestyles. 


(d) loss of accommodation: Infected 
persons have been evicted from or 
refused accommodation. 


(e) loss of public and private sector ser- 
vices: Discrimination may affect the 
provision of services. In the United 
States, the American Civil Liberties As- 
sociation has challenged or threatened 
to challenge several authorities that col- 
lected information on infected persons. 
In one case, the police stored names of 
infected persons. Officers sent on a call 
were then notified that the person was 
infected (often via police radio, which 
could be overheard with little difficulty 
by interested individuals). This infor- 
mation could reinforce in the officer’s 
mind the need to take health precau- 
tions (a good idea). Some argue, how- 
ever, that the police (or ambulance 
attendants, or firemen) might 
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deliberately avoid an encounter with an 
infected person and thereby deprive the 
person of essential services. 


Similar problems have arisen in schools. 
Infected children have been expelled or 
denied entry. Hospitals and health care 
workers may refuse to care for infected 
persons. Infected persons may be 
refused access to transportation 
facilities. They may be denied in- 
surance. 


(f) travel restrictions: Some countries 
may prohibit infected persons from 
entering for visits or immigration. If al- 
ready in the country, they may be or- 
dered to leave. 


One example is found in the United 
States policy on providing military train- 
ing for foreign personnel. Since May 31, 
1988, all foreign personnel entering the 
United States for military training under 
the Security Assistance Training Pro- 
gram must certify that they are HIV 
seronegative. Infected persons will be 
prevented from taking training in the 
United States. 


(g) government responses: To date, 
governments in Canada have taken no 
significant steps to isolate (quarantine) 
infected persons unless they deliberate- 
ly spread infection. 


The present position of any government, 
however, offers no guarantee for the fu- 
ture. Governments could decide to take 
any number of repressive (if sometimes 
impractical and ineffective) measures 
against infected persons. Among them 
are the following: isolation, banning 
sexual intercourse, banning homosexual 
activity, prosecuting those who unknow- 
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ingly spread the virus, limiting access of 
infected persons to various government 
services (police, fire, ambulance, 
hospitalization, education) and 
publicizing the identity of infected per- 
sons. 


Some of these government responses 
seem unlikely, but nothing is impossible. 
Hospital costs for care of AIDS patients, 
for example, may become staggering as 
the epidemic progresses. Governments 
may then be forced to decide who to 
treat -- those who health care services 
can cure, or those they cannot cure 
(AIDS patients). 


Similarly, governments may one day 
refuse to provide advanced education to 
an infected person. The person faces a 
substantial risk (and, some Say, a cer- 
tainty) of premature death. Why spend 
several years educating an infected per- 
son when he or she may succumb to 
AIDS shortly after? 


The American Civil Liberties Union has 
suggested also that future governments 
may hold different views on confiden- 
tiality: "There is no way to guarantee 
that, whatever the confidentiality 
provisions today, future laws won’t be 
passed to allow insurers, school systems, 
or other state agencies to have access to 
such a list [of infected persons]."” 


Added to the considerations in this list is the 
human dimension of AIDS. A diagnosis of 
HIV infection is traumatic. It tells the person 
that, although perhaps outwardly healthy, he 
or she may in fact be terminally ill. It is only 
humane to protect the person from the addi- 
tional trauma of a loss of control over a very 
significant piece of personal information. It 
is therefore doubly important to recognize 
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what the Supreme Court of the United States 
has called simply "the right to be let alone by 
other people". ? 


Clearly, the relative privacy afforded to 
AIDS-related personal information will 
determine the extent to which issues of dis- 
crimination arise. It is better to restrict col- 
lection, use and disclosure of AIDS-related 
information than to invite a plague of dis- 
criminatory actions and other forms of "evil" 
-- such as blackmail. Anti-discrimination 
legislation cannot undo the damage and ex- 
pense caused by playing fast and loose with 
AIDS-related personal information. Nor will 
it redress a perceived insensitivity to privacy 
concerns that in turn may deter individuals 
from seeking appropriate medical attention 
and testing. 


Even security of information and good inten- 
tions cannot prevent some leakage and the 
resultant discrimination and other conse- 
quences. The Annual Report: Privacy Com- 
missioner 1986-87 describes 12 incidents 
involving the theft or loss of personal infor- 
mation held by government.’ Among them 
were the following: 


e completed census forms falling off a 
truck; 


e theft of Parole Board files from a car; 
files contained institutional reports, 
criminal records, psychiatric records 
and various other reports; 


e personnel information from a govern- 
ment department found on an Ottawa 
street, and 


e theft of microfiche records containing 
information on 16 million Canadian tax- 
payers.” 


Theft or loss of personal information held by 
government will continue, despite statutory 
protections, penalties and the possibility of 
civil lawsuits where information is 
mishandled. 


(b) The Case for Collection, 
Use and Disclosure 


The public interest clearly justifies collecting, 
using and disclosing some AIDS-related in- 
formation. This may include epidemiological 
data to identify groups at risk, to track the 
spread of the disease, to assess the effective- 
ness of treatments and to test mechanisms for 
controlling the spread of AIDS and HIV in- 
fection. Governments also require informa- 
tion to plan the allocation of scientific and 
health care resources. 


It is often not necessary for this information 
to identify individuals. The collection, use 
and disclosure of anonymous information 
creates no danger of discrimination against 
an individual. (As has been seen with 
homosexuals, however, it may still cause ill- 
will towards certain identifiable groups). 


The real controversy lies with AIDS-related 
personal information. Those who favour col- 
lecting, using and disclosing AIDS-related 
personal information offer several justifica- 
tions (we do not necessarily accept these ar- 
guments): 


e The partner of an infected person 
should be told that he or she is at risk. 
Because there is no guarantee that the 
infected person will tell the partner, 
public authorities may be required to do 
so and, therefore, need the identity of 
the infected person. 
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e The infected person may need counsell- 
ing. Given the trauma associated with a 
diagnosis of HIV infection, such coun- 
selling may be vital. 


e The infected person may deliberately 
spread the infection. Public authorities 
should be aware of the identity of an 
infected person to be able to supervise 
his or her behaviour and take ap- 
propriate action. This may include 
criminal prosecution or taking action 
under provincial health protection legis- 
lation (quarantine, for example). 


These arguments are frequently used to sup- 
port reporting requirements under provincial 
legislation. The provinces typically assume 
the "contact-tracing" role and can ensure that 
persons are adequately counselled. They can 
(arguably) also apply provincial health 
protection legislation to safeguard the com- 
munity at large. 


Other reasons for collecting AIDS-related 
personal information can be advanced as 
being more relevant (although not exclusive- 
ly so) to federal institutions: 


e Those who come into contact with the 
infected person may need to be aware of 
the person’s condition to protect them- 
selves. This group includes those whose 
work may bring them into contact with 
infected body fluids -- health care per- 
sonnel, police officers, corrections of- 
ficers, ambulance attendants, nursery 
workers and undertakers. And even 
though there may be no scientific jus- 
tification for concern, some employees 
who fear contagion through casual con- 
tact may also wish to know the status of 
their co-workers. 
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e Superiors may want to know the health 


status of their subordinates to deter- 
mine suitable job assignments. Some 
persons performing "invasive" proce- 
dures as part of their employment (sur- 
geons, for example) may, if infected, 
contaminate others. Certain occupa- 
tions (for example, those directly affect- 
ing the safety of the public) demand 
unimpaired mental and physical health. 
Dementia and deterioration of the 
central nervous system can accompany 
AIDS and compromise essential safety 
requirements. It may therefore be 
necessary to remove infected persons 
from these occupations. Certain 
employees may require unimpaired 
health to be suitable for foreign travel or 
postings. The U.S. requirement for 
Canadians to be tested before par- 
ticipating in military training there (dis- 
cussed in Part IV) and the concern of 
External Affairs for the health of per- 
sonnel posted abroad provide examples 
of this situation. 


Certain populations (such as federal 
penitentiary inmates) are almost totally 
under the control of the federal govern- 
ment. The government should assume 
special responsibilities to protect their 
health. 


Certain federal activities (immigration, 
for example) impose corresponding 
responsibilities to protect the Canadian 
public from disease, from the financial 
burden of assuming the health care of 
others, or both. It is therefore relevant 
to know the HIV status of potential im- 
migrants. 


Infected persons may be eligible for 
government support. Unemployment 
Insurance, Canada Pension Plan and 
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Revenue Canada authorities, for ex- 
ample, take medical disabilities into ac- 
count for the operation of certain 
programs. Disclosure of medical condi- 
tion is a prerequisite for obtaining some 
benefits. 


e Some AIDS-related research may re- 
quire tracking individual cases. The in- 
formation must be provided in nominal 
form to be of any use in these limited 
number of cases. 


Clearly there are significant pressures on 
government institutions to collect and use 
AIDS-related personal information. And 
while the uses are certainly supportable the 
debate must be resolved as to what collec- 
tions are truly necessary and what limits 
should be placed on the uses of such sensitive 
information. While there are a host of laws 
besides the Privacy Act which offer protection 
for personal information (see Appendix II), 
they are not widely known or understood. 
Moreover, as with all laws, there is room for 
interpretation as to the most prudent manner 
in which they should be implemented in par- 
ticular cases. It is imperative that the govern- 
ment of Canada articulate a policy which sews 
this patchwork together and communicates it 
clearly to Canadians. Only then will 
Canadians be assured the protection neces- 
sary to encourage them to voluntarily seek 
HIV antibody testing and obtain AIDS infor- 
mation, counselling and treatment where 
necessary. 
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1. Most forms of discrimination identified 
here are based on surveys of American legal 
literature, which has dealt extensively with 
AIDS in recent years. The social and political 
environment in Canada may differ somewhat 
from that of the United States. Nonetheless, 
the same problems will almost certainly sur- 
face here. 


2. American Civil Liberties Union, Aids and 
Civil Liberties Project, "Mandatory Contact 
Tracing" (1988) at 3. 


3. Katz v. United States, (1967), 389 U.S. 347, 
per Stewart, J., delivering the majority 
opinion; referred to by Dickson, J., delivering 
the judgment of the Supreme Court of 
Canada in Hunter v. Southam (1984), 11 
D.L.R. (4th) 641 at 652. 


4. Annual Report: Privacy Commissioner 
1986-87 (1987) at 8-19. 
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PART ITI 


ISSUES AND RECOMMENDATIONS 


In view of the plethora of medical, legal and 
ethical issues associated with AIDS (of which 
confidentiality is but one) one might expect 
that government actions in this area would be 
guided by thoughtfully developed and consis- 
tently applied policies. Such is not the case. 
Although Health and Welfare Canada active- 
ly encourages employers in Canada to 
develop AIDS policies, the government of 
Canada -- our largest employer -- has not yet 
completed its development of one. In the 
absence of policy guidance from the Treasury 
Board of Canada (the government’s ad- 
ministrative policy centre) other government 
institutions are left on their own to deal with 
the AIDS issues which concern their 
employees. 


While some departments, notably the - 


Department of National Defence (DND), 
Correctional Service Canada (CSC) and the 
Canadian International Development Agen- 
cy (CIDA), have developed AIDS policies 
dealing with employees or clients, most have 
not. (A review of the practices and policies 
associated with the collection and use of 
AIDS-related personal information in 
selected departments is included as Appen- 
dix ITI). 


With the exception of Employment and Im- 
migration Canada, no departments have 
plans to seek authority to implement man- 
datory or compulsory HIV antibody testing. 
Employment and Immigration Canada 
favours the compulsory testing of all prospec- 
tive immigrants and long-term visitors to 
Canada. 


DND, as previously mentioned, requires that 
any military or civilian employee wishing to 
attend U.S. defence training be tested for the 
presence of the HIV antibody. While the 
U.S. makes this mandatory, DND points out 
that it is entirely voluntary for Canadians; no 
employee is obliged to take U.S. defence 
training. However, from the employee’s 
point of view it may not appear voluntary 
when the consequences of refusal may be 
detrimental to future promotional oppor- 
tunities and career options. 


We were pleased to discover no general move 
within government to collect AIDS-related 
personal information about employees, 
clients or the general public. Equally, we 
were surprised by the number of federal data 
banks which may contain such information 
and the wide variety of situations in which 
such information may come into federal 
hands. 


Thus, while we feel that a federal AIDS policy 
is overdue there is still time to implement a 
policy before any significant abuses occur. As 
confidentiality and controls on the collection 
of AIDS-related personal information should 
be integral elements of such a policy, the 
recommendations in this report are intended 
as guidance. 


We also suggest that Treasury Board consider 
the June, 1988 "Statement from the Consult- 
ation on AIDS and the Workplace", issued by 
the World Health Organization in associa- 
tion with the International Labour Office. 
The statement addresses several issues relat- 
ing to AIDS and employment. 
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The statement asserts that pre-employment 
HIV screening as part of the assessment of 
fitness to work is unnecessary and should not 
be required. Screening of this kind refers to 
direct methods (HIV testing) or indirect 
methods (assessment of risk behaviours) or 
to questions about HIV tests already taken. 
It notes concerns that pre-employment HIV 
screening for insurance or other purposes 
may lead to discrimination. 


About current employees the statement 
makes several policy recommendations: 


e HIV screening should not be required, 
whether direct (HIV testing), indirect 
(assessment of risk behaviours) or as- 
king questions about tests already taken; 


e Confidentiality must be maintained 
about all medical information, including 
HIV status; 


e The employee should not be obliged to 
inform the employer about his or her 
HIV status; 


e Employees affected by, or perceived to 
be affected by HIV, must be protected 
from stigmatization and discrimination 
by co-workers, unions, employers or 
clients. Information and education are 
essential to maintain the climate of 
mutual understanding necessary to en- 
sure the protection; 


e Iffitness to work is impaired by HIV-re- 
lated illness, reasonable alternative 
working arrangements should be made; 


e HIV infection is not a cause for termina- 


tion of employment. As with many 
other illnesses, persons with HIV-re- 
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lated illnesses should be able to work as 
long as medically fit for available, ap- 
propriate work. 


Our primary recommendation, then, is this: 
Recommendation 1 


Treasury Board take steps to issue a com- 
prehensive policy on AIDS in the workplace; 
this policy should include a clear statement 
on confidentiality and the controls on the 
collection of AIDS-related personal informa- 
tion, guided by the principles and recommen- 
dations set forth in this report. 


Controlling Collection, Use 
and Disclosure 


The Privacy Act is a blunt instrument for deal- 
ing with AIDS-related personal information. 
Intended to apply almost government-wide 
to a variety of circumstances relating to the 
holding of personal information, its broad 
approach may lack the finesse to deal with the 
extraordinary sensitivity of this information. 
The Act gives little comfort to those who fear 
any form of organized assembly of AIDS-re- 
lated personal information. The best 
evidence of this lies in the extensive list of 
data banks that were identified to us as hold- 
ing or having the potential to hold this infor- 
mation. 


How we handle AIDS-related personal infor- 
mation can have a significant impact on other 
AIDS-related issues. If information 1s widely 
collected and disclosed it may lead to extreme 
forms of discrimination at work, at home and 
in the community. The degree of protection 
afforded AIDS-related personal information 
largely determines the extent to which many 
other issues will arise. Moreover, a perceived 
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insensitivity to privacy concerns may deter 
individuals from being tested voluntarily for 
antibodies to the virus. 


(a) Limiting Collection 


One defence against too much zeal in the use 
and disclosure of AIDS-related personal in- 
formation lies in restrictions on collection. 
As discussed elsewhere, not only HIV an- 
tibody test results should be subject to those 
restrictions. The collection of AIDS-related 
personal information in general, as defined in 
Part I, should also be restricted. 


A truly anonymous testing program creates 
few concerns under the Privacy Act. With an 
anonymous test, the person being tested is the 
only one who can match the results of the test 
with his or her blood sample. Even the 
person’s physician is not aware of the results. 


Anonymous testing, while not perfect (other . 


AIDS-related personal information -- for ex- 
ample, that the person took the test -- might 
still be known), is the least intrusive testing 
option. Any form of testing that links the 
name of the individual with the test results is 
much more intrusive (although it is possibly 
also more useful to provincial public health 
authorities and to federal government in- 
stitutions). 


Any program of testing has the potential to 
create a body of AIDS-related personal infor- 
mation which must be stored, and which may 
be used and disclosed. Decisions to test must 
take into account the responsibilities that 
flow from collection. 


Section 4 of the Privacy Act is the principal 
control on the collection of AIDS-related 
personal information: 


No personal information shall be col- 
lected by a government institution unless 
it relates directly to an operating program 
or activity of the institution. 


It is not sufficient for an institution wishing to 
collect such information simply to point to or 
to create a program involving the use of 
AIDS-related personal information. Implicit 
in section 4 is the requirement that no such 
information is to be collected unless (1) the 
collection is part of an activity or program 
falling within the statutory mandate of the 
institution and (2) the collection is a neces- 
sary element of a mandated program or ac- 
tivity. 


There is the potential for an institution to 
react to AIDS by collecting volumes of per- 
sonal information. Various levels of govern- 
ment in the United States and elsewhere have 
been ingenious in justifying the collection of 
AIDS-related personal information. 


And there will inevitably be situations where 
the need to collect is strongly arguable. A 
government institution that sends employees 
abroad, for example, might want to exclude 
those infected with the HIV from travelling 
to certain areas of the world. The collection 
of AIDS-related personal information could 
relate to an operating program or activity (the 
posting process) of the institution, even 
though information of that detail may not be 
needed to administer the posting program. 


Institutions should review their reasons for 
collecting AIDS-related information. Is col- 
lection necessary or is a general diagnosis of 
medical fitness sufficient? Can non- nominal 
information serve the purpose just as well? If 
AIDS- related personal information is neces- 
sary, can it be collected by Health and Wel- 
fare Canada? Health and Welfare Canada’s 
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general advice based on that detailed infor- 
mation could then be used by another institu- 
tion to make administrative decisions. 


"Necessity" cannot be defined precisely, given 
the broad spectrum of situations and persons 
giving rise to the collection of personal infor- 
mation. It will vary with the circumstances. 
For example, the necessity criterion applied 
to collecting information about immigrants 
may differ from that for inmates of federal 
institutions, given the government’s differing 
responsibilities towards each group. 


Moreover, the necessity principle will have to 
be considered in determining the means of 
collecting AIDS-related personal informa- 
tion. The principle may operate to justify 
voluntary HIV antibody testing but may 
militate against mandatory or compulsory 
testing. For example, DND’s current HIV 
antibody testing of candidates for U.S. 
Defense Department courses could be jus- 
tified as necessary in its present voluntary 
form. It would not be justified if mandatory. 


A special word is required about public 
employees. The current medical knowledge 
about the transmission of HIV infection is 
clear; normal workplace contact with an in- 
fected individual does not put others at risk. 
As a general principle, then, section 4 of the 
Privacy Act would prohibit government in- 
stitutions from collecting AIDS- related per- 
sonal information about public employees. 


Strong arguments have been made that the 
HIV status of certain employees is a matter 
of legitimate interest to the government as 
employer -- for example, where the employee 
performs invasive procedures, the employee 
travels to countries which bar entry to those 
infected with the HIV or the employee per- 
forms duties which affect public safety. In 
fact, the Canadian Human Rights Commis- 
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sion, in its AIDS testing policy, specifically 
identifies the above-mentioned situations as 
ones for which being HIV infection-free may 
be considered a bona fide occupational re- 
quirement under the Canadian Human 
Rights Act. 


In our view, even in some of those situations 
itis doubtful whether the necessity test can be 
met. Health and Welfare Canada considers 
that with the adoption of universal precau- 
tions in high-risk work environments it is ex- 
tremely rare to find an occupational setting 
where it is essential, in the interests of in- 
dividual or public safety, to establish being 
HIV infection-free as ajob requirement. The 
"necessity" principle embedded in section 4 of 
the Privacy Act would, therefore, be very dif- 
ficult to demonstrate in order to justify the 
collection of AIDS- related personal infor- 
mation about federal public employees. 


A caveat must be entered, however, with 
respect to members of the Canadian Forces. 
Occupational situations may arise here -- for 
example, in battlefield conditions -- which 
require that an individual’s HIV status be 
known. DND takes the position that, while 
no mandatory or compulsory HIV antibody 
testing program is planned, it would not be 
prudent to rule it out in the future in specific 
circumstances. 


In the opinion of the Privacy Commissioner, 
further study is required to determine 
whether, to what extent and under what 
safeguards, AIDS-related personal informa- 
tion may be collected by DND about mem- 
bers of the Canadian Forces. 


Apart from the Canadian Forces situation 
described above, our consultations have not 
established any compelling public health or 
administrative reasons why mandatory or 
compulsory testing is a necessary element of 
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the administration of existing departmental 
mandates. In particular, the need for com- 
pulsory or mandatory testing of inmates of 
federal penitentiaries, new immigrants, long 
term visitors or public servants posted abroad 
has not been demonstrated. 


It is our view, therefore, that section 4 of the 
Privacy Act would prohibit the collection of 
AIDS-related personal information through 
a process of mandatory or compulsory test- 
ing. Only if such a process were to be specifi- 
cally authorized by statute would such 
collection conform with the requirements of 
the Privacy Act. 


Recommendation 2 


AIDS-related personal information avail- 
able through voluntary testing, the volun- 
tary provision of information, or both, 
should be collected only where the collection 
is a necessary element of the administration 
of a statutorily mandated program or ac- 
tivity of the institution. 


Recommendation 3 


No compulsory or mandatory HIV antibody 
testing should be implemented by govern- 
ment institutions unless specifically 
authorized by statute. Moreover, existing 
enabling provisions, such as section 7 of the 
Financial Administration Act, which do not 
specifically address the collection of AIDS- 
related personal information, should not be 
relied on to authorize such collections. 


Recommendation 4 


Further study should be undertaken to 
determine whether, to what extent and under 
what safeguards, DND should collect AIDS- 
related personal information concerning 
Canadian Forces members. 


(i) Safeguarding Information 
that is Collected 


Even where the above conditions for collec- 
tion of AIDS-related personal information 
are met, it may be prudent to request that 
such information be collected by Health and 
Welfare Canada where possible (in some 
situations, for example, when collecting in- 
formation about CF members, inmates or 
immigrants, this may not be possible). 
Health and Welfare Canada can then provide 
departments with conclusions about medical 
fitness rather than specific HIV status infor- 
mation. 


Although centralizing most AIDS records 
with Health and Welfare Canada risks an 
information catastrophe if the information is 
lost, leaked or stolen, the risk can be greatly 
reduced by intelligent security procedures 
and employee education programs. And it 
should be easier to centralize and secure the 
information at Health and Welfare Canada 
than it would be to secure lesser quantities of 
AIDS-related personal information held at 
various locations by individual government 
institutions. Accordingly, we support the 
centralization of this information to the ex- 
tent possible, and under rigid security. 


(ii) Informed Collection from 
Individuals 


Subsection 5(1) of the Privacy Act requires 
that, wherever possible, personal informa- 
tion be collected directly from the individual 
except where the individual authorizes other- 
wise or where personal information may be 
disclosed to the institution under subsection 
8(2). Subsection 5(2) requires that the in- 
stitution inform an individual from whom 
personal information is collected of the pur- 
pose of the collection. 
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Subsection 5(3) makes the preceding subsec- 
tions inapplicable in two circumstances: 
where compliance with subsections 5(1)and 
(2) might result in the collection of inaccurate 
information or might defeat the purpose or 
prejudice the use for which the information 
was collected. 


Wherever possible, information about HIV 
status should be collected directly from the 
person, not from other records on the person 
or from third parties. 


We anticipate that government institutions 
will not rely on subsection 5(3) either to avoid 
direct collection or to avoid informing the 
individual of the purpose of collecting infor- 
mation. Neither direct collection or inform- 
ing about purpose should defeat the purpose 
or prejudice the use for which the informa- 
tion is collected. Nor should it result in the 
collection of inaccurate information. 


Subsection 5(3), however, has a gap. It only 
requires an individual from whom informa- 
tion is collected to be informed of the pur- 
pose. If the information is collected from a 
third party (perhaps a provincial health 
laboratory or a provincial correctional ser- 
vice) the individual concerned apparently has 
no right to be informed of the purpose of the 
collection. Even so, institutions should con- 
sider, if at all practical, informing persons that 
AIDS-related personal information is being 
collected about them, and the purpose of the 
collection. Otherwise, the person is disad- 
vantaged on two counts. He or she does not 
know either that information is being col- 
lected, or the purpose of the collection. 


Recommendation 5 
Wherever possible, AIDS-related personal 


information should be collected directly 
from the person affected, and not by consult- 
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ing records or a third party (except where the 
individual authorizes otherwise or where 
personal information may be disclosed 
under subsection 8(2)), and 


Wherever possible, when collecting AIDS-re- 
lated personal information, including collec- 
tion from records or a third party, the 
institution should inform the person to 
whom the information relates of the purpose 
of the collection and the source of the collec- 
tion. 


(b) Controlling Use under 
Section 7 


(i) Section 7 -- Consistent Uses 


Section 7 states: 


Personal information under the control 
of a government institution shall not, 
without the consent of the individual to 
whom it relates, be used by the institution 
except 


(a) for the purpose for which the infor- 
mation was obtained or compiled by the 
institution or for a use consistent with 
that purpose; or 


(b) for a purpose for which the informa- 
tion may be disclosed to the institution 
under subsection 8(2). 


The initial constraints we propose on the col- 
lection of AIDS-related personal informa- 
tion should limit the number of institutions 
having control over the information. If its 
collection were necessary in the first place, 
there should be few objections to its use 
under section 7. To be safe, however, those 
acting under section 7 should again consider 
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whether the purpose for which the informa- 
tion was obtained was a necessary purpose or 
whether the consistent use was necessary. 


The nature of "consistent uses" merits further 
comment. Information might be collected 
about a military recruit, for example, to deter- 
mine if the recruit should undergo a 
strenuous training regimen. It would not be 
a consistent use to disclose that information 
to colleagues who fear contagion through 
casual contact. 


Subsection 9(4) of the Privacy Act imposes 
reporting requirements for certain consistent 
uses of personal information: 


Where personal information in a personal 
information bank under the control of a 
government institution 1s used or disclosed 
for a use consistent with the purpose for 
which the information was obtained or 
compiled by the institution but the use is 
not included in the statement of consistent 
uses set forth pursuant to subparagraph 
I1(1)(a) (wv) in the index referred to in 
section 11, the head of the government 
institution shall 


(a) forthwith notify the Privacy Com- 
missioner of the use for which the infor- 
mation was used or disclosed; and 


(b) ensure that the use is included in the 
next statement of consistent uses set 
forth in the index. 


Due to the extremely sensitive nature of 
AIDS-related personal information, care 
must be taken to control consistent uses 
Strictly. Where a consistent use is proposed, 
advance notification should be given to the 
Privacy Commissioner, and no such use 
should be undertaken without the approval of 
the head of the government institution. 


As well, any proposed use of AIDS-related 
personal information which relies on subsec- 
tion 7(b) (use for a purpose for which the 
information may be disclosed to the institu- 
tion under paragraphs 8(2)(e) to (m)) should 
be subject to senior level review and the ap- 
proval of the head of the institution. This is 
particularly important where the proposed 
use is for research or statistical purposes. 


Recommendation 6 


AIDS-related personal information should 
be used only as follows: 


i) for the purpose for which the informa- 
tion was compiled or obtained by the 
institution, 


ii) for a use consistent with that pur- 
pose, or 


iii) for a purpose for which the informa- 
tion may be disclosed under subsection 
8(2). 


In situation ii), no use should be undertaken 
without the approval of the head of the 
government institution. In situation iii), no 
use should be undertaken under paragraphs 
8(2)(e) to (m) without the approval of the 
head of the government institution. 


(ii) Accuracy of Information 


Subsection 6(2) of the Privacy Act states: 


A government institution shall take all 
reasonable steps to ensure that personal 
information that is used for an ad- 
ministrative purpose by the institution is 
as accurate, up-to-date and complete as 
possible. 


PART III - 21 


AIDS and the Privacy Act 


This paper has already examined the conse- 
quences which can flow from a diagnosis of 
infection with the HIV. It is therefore vital 
on two counts -- to meet the accuracy require- 
ments of the Privacy Act and to prevent an 
erroneous diagnosis that may lead to serious 
discrimination -- that information on the HIV 
status of an individual be accurate, up-to-date 
and complete, if it must be kept at all. 


In populations of persons undertaking high 
risk activities, the ELISA screening test is 
acceptably accurate in determining seronega- 
tive or Seropositive status. In low risk popula- 
tions the rate of false positives using only a 
screening test is unacceptably high. In both 
situations, confirmatory tests must be used to 
reduce the likelihood of false positives being 
recorded. 


Seropositive Results; Data banks should 
never confirm the HIV status of a person if 
only screening (ELISA) tests have been per- 
formed. Only if a confirmatory test (Western 
Blot, IFA or RIPA) has confirmed the find- 
ings of the initial screening tests should a 
confirmed "seropositive" status be recorded. 
Otherwise, the data bank should indicate the 
results of the initial screening tests, but state 
clearly that this is not to be taken as a con- 
firmed finding of seropositivity. A seroposi- 
tive result from a screening test should not be 
used for an administrative purpose. 


This recommendation applies to seropositive 
results even if the person being tested is 
known or assumed to fall into a high risk 
category. Ifthe results of screening tests were 
accepted for high risk groups as confirming 
seropositivity, the conclusion would have to 
be supported by an assessment that the per- 
son belongs to a high risk group. This would 
inevitably invite recording that a person is 
homosexual or an intravenous drug user. 
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Above all, it would represent an intrusion 
into privacy that can easily be avoided by 
conducting confirmatory tests. 


This recommendation is based on the current 
level of accuracy of screening and confir- 
matory tests. Tests may become more ac- 
curate. One test may then be sufficient to 
diagnose seropositivity even in low risk 
groups. Even so, although tests may become 
increasingly accurate, the testing facility can 
make mistakes. It may still be necessary then 
to perform multiple tests before placing a 
confirmed finding in a data bank. 


Where there are clinical symptoms of infec- 
tion or disease, a physician should encourage 
a patient to be tested. Even if the patient 
does not get tested, the physician should be 
allowed to place on the medical record an 
opinion suggesting symptomatic HIV infec- 
tion. This information should be allowed to 
be used for an administrative purpose. 


The physician should not, however, confirm 
seropositivity unless the screening tests and 
confirmatory tests outlined above have been 
conducted. To attempt to confirm 
seropositivity without testing might violate 
the requirement of subsection 6(2) that the 
information collected be as accurate and 
complete as possible. 


Because seropositivity is usually lifelong, an 
accurate initial diagnosis remains accurate. 
Therefore, it can be considered "as up-to- 
date" as possible, as required by subsection 
6(2). 


Recommendation 7 


To meet the requirements of subsection 6(2), 
a record of a finding of seropositivity on the 
basis of screening testing only should never 
be used for an administrative purpose. Only 
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a seropositive result after a confirmatory test 
should be used for an administrative pur- 
pose. 


Arecord ofa medical opinion suggesting that 
a person has symptomatic HIV infection may 
be used for an administrative purpose, even 
without HIV antibody tests being performed. 
However, only a confirmatory test result 
should be used to confirm seropositivity. 


Seronegative Results: No confirmatory test- 
ing should be required when a test result 
shows seronegativity. 


Nonetheless, testing procedures cannot 
repair the deficiencies inherent in a finding 
of seronegativity. Even if the test is carried 
out in the best laboratory conditions, it does 
not prove that a person is free of HIV infec- 
tion. The person may in fact have become 
infected, but might not yet have developed 
antibodies. Moreover, infected persons may 


lose antibodies as their immune system 


deteriorates. Some scientists now argue that 
some infected persons may never develop the 
antibodies that testing seeks to locate. In 
these three situations, tests would show 
seronegativity, when in fact those tested 
would be infected with the HIV. Nor is the 
test a guarantee that a seronegative person 
will not later become infected through risky 
conduct or accident. This leaves the door 
open Stor challenge: ia) recording of 
seronegativity as not being "as accurate as 
possible" under subsection 6(2). 


Furthermore, any record of seronegativity 
could be challenged as out-of-date as soon as 
itis taken. At first glance, this might seem to 
violate the requirement of subsection 6(2) 
that the personal information be as up-to- 
date as possible. There is likely no practical 
manner, however, to conduct the frequent 
repeat testing necessary to ensure the curren- 


cy of a finding of seronegativity. A single 
finding will therefore likely be acceptable as 
as up-to-date as possible (although some 
might argue that the institution should have 
the obligation to ensure the currency of the 
information by having repeat tests performed 
periodically). 


Ideally, one would want to abandon 
seronegative test results as being inherently 
unreliable. But these tests are today’s only 
practical and specific indicators of 
seronegativity. They should therefore be ac- 
cepted as complying with subsection 6(2) 
until a better diagnostic tool is developed. 
Those using seronegative results for an ad- 
ministrative purpose as defined by the Privacy 
Act must always be made aware of their 
limitations. 


Recommendation 8 


To meet the requirements of subsection 6(2), 
a finding of seronegativity based on a single 
screening test performed under appropriate 
laboratory conditions should be considered 
"as accurate as possible" and might be relied 
on for an administrative purpose. Nonethe- 
less, those using the information for an ad- 
ministrative purpose should be made aware 
of the deficiencies inherent in any finding of 
seronegativity. 


(c) Disclosure of 
AIDS-related Personal 
Information 


The real leak in the system stems from section 
8, which deals with disclosure of personal 
information. Subsection 8(1) states: 
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Personal information under the control of 
a government institution shall not, 
without the consent of the individual to 
whom it relates, be disclosed by the institu- 
tion except in accordance with this sec- 
tion. 


Subsection 8(2) lists 13 situations where per- 
sonal information may be disclosed without 
the consent of the individual. 


For example, disclosure without consent is 
permitted to other governments or agencies 
of governments, to Members of Parliament, 
to the National Archives and to researchers. 
Under subparagraph 8(2)(m)(i), information 
may disclosed for any purpose where the head 
of the institution thinks that the public inter- 
est in disclosure clearly outweighs any in- 
vasion of privacy that could result from the 
disclosure. 


While subsection 8(2) authorizes certain dis- 
closures without consent, none of its 
provisions are mandatory. As well, although 
departments have discretion whether to 
release personal information without con- 
sent, all but two of the provisions of subsec- 
tion 8(2) do not say who must exercise the 
discretion. Disclosures to researchers 
(8(2)(j)) and disclosures in the public interest 
(8(2)(m)) require the consent of the head of 
the institution. 


This state of affairs is particularly troubling in 
the case of AIDS-related personal informa- 
tion. It is our view that the discretion to 
release this information without consent 
under paragraphs 8(2)(e) to (m) should be 
exercised only at the most senior levels -- 
preferably by the head of the institution. 


Moreover, requests for disclosures under 


these paragraphs should not simply be met as 
a matter of course. In these cases, an attempt 
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should be made to obtain the consent of the 
affected individual. If consent is refused, the 
onus should rest with the individual or body 
seeking the information to justify the dis- 
closure. This process would involve a review 
of (1) why disclosure is necessary, (2) the 
possible adverse consequences that dis- 
closure will bring to the individual, (3) the 
likelihood that the requestor can and will 
maintain it in confidence, and (4) the 
likelihood that the requestor will use it only 
for the purpose for which it was originally 
sought. 


Subparagraph 8(2)(m)(i) (disclosure in the 
public interest) requires special mention. It 
is broad enough to allow the head of the 
institution to make it public knowledge that a 
person is infected with the HIV. Co-workers 
or a person’s superiors, for example, might 
want disclosure on this basis. Given the 
severe consequences of disclosure, in what 
circumstances can the public interest in dis- 
closure be said to outweigh any invasion of 
personal privacy? 


Our strongest argument against disclosure in 
the public interest is evidence that AIDS is 
not spread by casual contact and that it need 
not affect a person’s abilities to carry on his 
or her work. Only if the infected person were 
to attempt to spread the virus (perhaps by 
donating blood, sharing needles or engaging 
in unprotected intercourse) does there seem 
to be any public interest in disclosing his or 
her infection. Even then, there may be other 
far less intrusive measures that can resolve 
the problem. 


Disclosure to co-workers cannot normally be 
justified, no matter how great their concern 
about casual contagion. Even disclosure to a 
superior may not be justified in the public 
interest, unless there is a bona fide occupa- 
tional requirement that the subordinate be 
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seronegative. Even then, the superior may 
not need to know the precise details of the 
medical condition that impairs the subor- 
dinate. 


Accordingly, there seems little justification 
for relying on the public interest argument to 
disclose AIDS-related personal information 
to co-workers, superiors, government institu- 
tions or the general public. 


Our view is buttressed by the history of the 
use of subparagraph 8(2)(m)(i). Subsection 
8(5) requires the head of a government in- 
stitution to notify the Privacy Commissioner 
of any disclosure of personal information 
under paragraph 8(2)(m). A review of past 
notifications has shown that disclosure of in- 
formation under subparagraph 8(2)(m)(i) 
has occurred in circumstances far less harm- 
ful to the person affected than would likely be 
the case with the release of AIDS-related 
personal information. 


Notifications have related to a range of mat- | 


ters -- name and address, academic creden- 
tials, place of birth, date of birth, citizenship 
status and the parole status of inmates, for 
example. 


Medical information has only rarely been 
released. In two cases, the medical history of 
a deceased parent was released to a surviving 
family member who may have inherited the 
parent’s disease. In one case, medical and 
psychiatric records were released to the 
RCMP to deal with a hostage situation. 


Information released under this sub- 
paragraph was typically released to another 
individual or to a small group of individuals. 
Often it was released to family members. 
Sometimes the media was given information 


through a government institution. One can 
therefore assume that widespread publica- 
tion was anticipated. 


Recommendation 9 


The following policy should govern dis- 
closures of AIDS- related personal informa- 
tion: 


No disclosure of AIDS-related personal in- 
formation should be made to third parties 
under paragraphs 8(2)(e) to (m) without 
first seeking to obtain consent from the in- 
dividual for the release. There would be no 
need to seek consent before disclosing this 
information under paragraphs 8(2)(a) to 


(d). 


Where consent to disclose is not given, no 
disclosure should be made to third parties 
under paragraphs 8(2)(e) to (m) without the 
approval of the head of the institution. This 
approval would not be required for dis- 
closures under paragraphs 8(2)(a) to (d). 


In exercising discretion to disclose under 
subsection 8(2)(e) to (m) the head of the 
institution should review 


(1) why disclosure is necessary 


(2) the potential adverse consequences 
of the disclosure on the individual(s) to 
whom it relates, 


(3) the likelihood that the requestor can 
and will maintain the confidentiality of 
the information and 


(4) the likelihood that the requestor will 
use it only for the purpose for which it 
was originally sought. 
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Where a third party requests disclosure of 
AIDS-related personal information under 
paragraphs 8(2)(e) to (m), the onus should 
be placed on the requestor to justify the dis- 
closure of the information. 


(1) Disclosure to Provincial 
Governments 


Most HIV antibody testing is done in provin- 
cial laboratories. Legislation in seven of ten 
provinces requires positive results to be 
reported to provincial health authorities. 


There may, however, be situations where 
laboratories do not report test results to 
provincial authorities. Should a federal in- 
stitution report test results to provincial 
authorities? 


Tests may have been performed outside 
Canada -- for example, on a foreign service 
officer posted abroad. Should External Af- 
fairs or Health and Welfare Canada report 
the test results to authorities in the foreign 
service officer’s Canadian province of 
residence? Is the federal institution or an 
employee of the institution (a physician, for 
example) obliged to report under provincial 
law? If not, would reporting violate the 
Privacy Act? 


There appears to be a conflict between the 
disclosure provisions of the Privacy Act and 
provincial legislation requiring that persons 
with AIDS or those infected with HIV be 
reported to provincial health authorities. 
Subsection 8(2) defines the situations in 
which disclosure of personal information may 
be made without consent. The subsection 
8(2) disclosure provisions are subject only to 
"[the disclosure requirements of] any other 
Act of Parliament" and do not include report- 
ing under provincial legislation. 
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Paragraph 8(2)(f) would allow a federal in- 
stitution to disclose AIDS-related personal 
information to a province for the purpose of 
administering or enforcing any law or carry- 
ing out a lawful investigation. If an agree- 
ment is in place, reporting to a province 
clearly would not violate the Act. 


Information-sharing agreements were 
entered into between the federal government 
and most (though not all) provinces in 1983, 
just prior to the coming into force of the 
Privacy Act. These agreements were narrow- 
ly drafted to cover the exchange of informa- 
tion for law enforcement. Before any federal 
institution discloses AIDS-related personal 
information to a provincial health authority, 
appropriate agreements should be in place. | 
In rare cases it could also be argued that there 
is a public interest in disclosing the informa- 
tion under paragraph 8(2)(m), even if no 
agreement is in place. 


Recommendation 10 


AIDS-related personal information should 
be disclosed to provincial governments or 
their agencies only under paragraph 8(2)(f) 
agreements, except in rare cases where the 
public interest calls for disclosure without an 
agreement being in place. 


Existing federal/provincial information 
sharing agreements should be reviewed to 
determine whether the sharing of AIDS- re- 
lated personal information with provincial 
health authorities is covered. 


No information should be disclosed pur- 
suant to paragraph 8(2)(f) agreements un- 
less the conditions contained in 
Recommendation 9 are also met. 
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(ii) Disclosure to Foreign 
Governments 


This report does not deal extensively with 
disclosures of AIDS-related personal infor- 
mation to foreign governments. Part IV dis- 
cusses ways to limit access by the U.S. 
government to AIDS-related personal infor- 
mation that Canada collects about those 
taking part in U.S. Department of Defense 
courses. But it does not address disclosures 
beyond this one limited situation. Yet the 
disclosure of this information to foreign 
governments should be of equal, if not 
greater, concern than the disclosure of infor- 
mation to provincial governments. 


The Privacy Act permits an "agreement or 
arrangement" to disclose personal informa- 
tion. to foreign governments and internation- 
al organizations (paragraph 8(2)(f)) for the 
purpose of administering or enforcing any 
law or carrying out a lawful investigation. 


Once information is given to a foreign institu- 
tion, there may be little control over its use. 
Even if the agreement or arrangement sets 
strict terms on the uses of the information, 
there may be no effective way of ensuring 
compliance. Given the panic associated with 
AIDS, foreign recipients of AIDS-related 
personal information could put it to uses that 
were prohibited by an agreement. 


There are probably few, if any, situations 
where Canada should share AIDS-related 
personal information with foreign institu- 
tions. We stress the danger of sharing this 
information across borders -- the primary one 
being the practical loss of control over use 
and disclosure. Of course, there is no privacy 
concern arising from the transfer of 
epidemiological data, as long as it is not pos- 
sible to identify an individual from the data. 


The same restrictions that we recommend for 
disclosures of information to provincial in- 
stitutions should apply to disclosures to 
foreign states or international institutions. 


(d) Access to a Person’s 
Own AIDS-related Personal 
Information 


(i) General 


Subsection 12(1) of the Privacy Act gives in- 
dividuals a right of access to personal infor- 
mation about them. The information may be 
contained in a personal information bank or 
it may be otherwise under the control of a 
government institution. 


Subsection 12(2) sets out the rights of in- 
dividuals given access. The subsection ap- 
plies only where the information has been 
used, is being used or is available for use for 
an administrative purpose. 


The subsection permits the individual to do 
any or all of the following: 


(a) request correction of the personal in- 
formation where the individual believes 
there is an error or omission therein; 


(b) require that a notation be attached to 
the information reflecting any correction 
requested but not made; and 


(c) require that any person or body to 
whom such information has been dis- 
closed for use for an administrative pur- 
pose within two years prior to the time a 
correction is requested or a notation is 
required under this subsection in respect 
of that information 
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(i) be notified of the correction or nota- 
tion, and 


(it) where the disclosure ts to a govern- 
ment institution, the institution make 
the correction or notation on any copy 
of the information under its control. 


The right of access and the right to request 
correction, or to require notation and 
notification are generally available only to 
Canadian citizens or permanent residents. 
Under subsection 12(3), the Governor in 
Council may also extend the right of access to 
other individuals. In June 1983 these rights 
were extended to inmates of federal peniten- 
tiaries who are not Canadian citizens or per- 
manent residents’. 


The right of access is not absolute. Access is 
not permitted to several categories of infor- 
mation: that obtained in confidence from a 
foreign government, an international or- 
ganization of states, a government of a 
province or a municipal or regional govern- 
ment. Other categories of personal informa- 
tion that cannot be released include 
information that could reasonably be ex- 
pected to be injurious to the conduct of 
federal-provincial affairs or the conduct of 
international affairs or the defence of Canada 
or her allies*. Similarly, under section 22, the 
release of personal information relating to 
certain law enforcement activities may be 
refused. 


Where provinces provide non-nominal infor- 
mation, the Privacy Act does not apply. How- 
ever, if a provincial government provides 
nominal information in confidence, an in- 
dividual could not obtain access at the federal 
level. A federal government institution may 
not release it. 


28 - PART III 


AIDS and the Privacy Act ————— Ke qoq_s_i“*me> oO 


If the individual is permitted to review the 
information at the provincial level, any cor- 
rection can be passed on by the province to 
the federal institution. If, however, the 
province does not allow the individual to cor- 
rect the information, or if the information was 
collected without the knowledge of the in- 
dividual, errors could reach federal data 
banks. Even accurate information received 
from a province could be transcribed incor- 
rectly by the federal institution. Decisions 
may then be based on this inaccurate infor- 
mation. 


This predicament can be avoided. The 
federal government can refuse to accept 
AIDS-related personal information supplied 
confidentially by a province. As an alterna- 
tive, it can negotiate an agreement with the 
province that will permit a federal institution 
to process such information under the Privacy 
Act as if it were federal information. Thus, 
even if the person has no recourse at the 
provincial level, he or she would be able to 
review and correct or contest the information 
once it is stored in federal data banks. We 
would allow three exceptions to this general 
rule: where acceptance of the information in 
confidence by the federal government is 
necessary for the safety of an individual, 
where it is necessary for the public safety, or 
where it is essential for the operational effec- 
tiveness of a federal statutory program. 


In general, whenever information originates 
from a provincial government institution, a 
person should be permitted access to that 
information as if it were collected directly by 
a federal institution. This rule would be sub- 
ject to the exceptions listed immediately 
above and to other limitations contained in 
the Privacy Act, some of which are discussed 
below. If a provincial institution attempts to 
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restrict access to personal information banks 
unreasonably, the federal government in- 
stitution should not collect the information. 


Similarly, federal institutions should collect 
AIDS-related personal information from a 
foreign institution only where the collection 
meets the collection requirements of the 
Privacy Act and the other recommendations 
made in this report. Among the require- 
ments for receiving AIDS-related personal 
information from a foreign institution would 
be the right for Canada to treat the informa- 
tion as if it were collected under the Act. As 
well, special care might be needed to ensure 
the accuracy of the information. 


Recemmendation 11 


A federal government institution should or- 
dinarily accept AIDS-related personal infor- 
mation from a provincial government 
institution only where the providing institu- 


tion agrees that the information may be 


processed in accordance with the Privacy Act 
as if it were federal information. 


Exceptions to this general rule should be 
permitted where it is necessary for in- 
dividual or public safety or where it is essen- 
tial to the operational effectiveness of a 
statutory program. 


The right of access under section 12 is subject 
to other constraints. Section 28 permits the 
head of a government institution to refuse to 
disclose to individuals personal information 
about their physical or mental health if 
examining the information would be contrary 
to their best interests. 


Only rarely would it be possible for a govern- 
ment institution to refuse to disclose AIDS- 
related personal information under this 
provision. The individual would probably al- 


ready have been informed about his or her 
HIV status by a physician. There seems little 
point in refusing to allow access to that or 
related information by relying on section 28. 
Furthermore, a person who is refused infor- 
mation about his or her HIV status is almost 
certain to interpret the refusal as meaning 
that he or she is seropositive (why, after all, 
would an institution head fear telling some- 
one that he or she is not infected?). 


Refusal to disclose under section 28 is there- 
fore largely a non-issue. In the unlikely event 
that the head of the institution still wishes to 
refuse to disclose AIDS-related personal in- 
formation (perhaps, for example, that a test 
has been performed without the subject’s 
knowledge), the refusal should be supported 
by the opinion of a qualified medical prac- 
titioner that disclosure would be contrary to 
the best interests of the individual. In addi- 
tion, the individual must be informed of the 
right to complain to the Privacy Commis- 
sioner under subsection 29(2). 


Recommendation 12 


The head of a government institution should 
refuse under section 28 to disclose AIDS-re- 
lated personal information requested under 
subsection 12(1) only in rare circumstances. 
The refusal should be supported by the 
opinion of a qualified medical practitioner. 
The person requesting the information must 
be told of the right to complain to the Privacy 
Commissioner about the refusal. 


Section 25 of the Act permits the head of a 
government institution to refuse to disclose 
personal information requested under sub- 
section 12(1) where the disclosure could 
reasonably be expected to threaten the safety 
of individuals. As with section 28 refusals, it 
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is unlikely that section 25 will be relied on to 
refuse access to AIDS-related personal infor- 
mation. 


Disclosing to an individual that he or she is 
seropositive may threaten the safety of others 
if the person blames someone else for the 
HIV infection and seeks revenge. However, 
a refusal to disclose for this reason must be 
supported by some objective evidence. But 
even if the head of the institution refuses to 
disclose the information, the person will nor- 
mally have learned about his or her status 
from a physician. Thus information about 
seropositivity sought by the person via the 
Privacy Act will have been readily available 
through other means. Only where the infor- 
mation was not readily available to the person 
(for example, if the person was unaware of 
having been tested) should consideration be 
given to refusing disclosure under section 25. 


Recommendation 13 


Section 25 should not be relied on to refuse 
disclosure of AIDS-related personal infor- 
mation unless 


(1) there is some objective evidence in- 
dicating that the safety of individuals 
could be threatened, and 


(2) the person requesting the informa- 
tion does not have independent 
knowledge of the requested informa- 
tion. 


(ii) Challenging or Confirming 
Conclusions about Sero- 
negativity or Seropositivity 


Challenging or confirming test results that 
are stored in personal information banks 
presents difficulties. HIV antibody testing is 
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done almost exclusively by provincial 
laboratories (although tests on potential im- 
migrants may be conducted in other 
countries). Only where results from provin- 
cial laboratories are equivocal are samples 
sent to the Federal Centre for AIDS 
Retrovirus Laboratory. Accordingly, a 
federal government institution often will 
have no direct control over a blood sample. 
A person will not be able to obtain a sample 
under the authority of the Privacy Act to chal- 
lenge the results derived from that sample. 
The person may need to approach provincial 
laboratories to obtain the sample, provided it 
has been retained. 


Positive Test Results: In practice, a person 
can easily challenge a positive test result by 
giving another blood sample and being 
retested. Seropositivity is usually lifelong (al- 
though antibodies may disappear as the dis- 
ease progresses or, rarely, an individual may 
lose antibodies; both situations will result in 
a finding of seronegativity). If an accurate 
subsequent test shows seronegativity, the 
original test likely will have been wrong. 


If the person is still alive to provide a sub- 
sequent blood sample, there is most likely no 
practical need to retain the original blood 
sample to challenge a finding of 
Seropositivity. Where the person has died, 
and no subsequent blood sample is available, 
the only way to challenge the accuracy of the 
original test will lie in retesting the original 
sample. We think that the need for retesting 
after death will arise infrequently. Generally, 
only where the person’s estate has an interest 
in challenging the finding would the need 
arise. 


Negative Test Results: The results from a 
blood sample taken subsequently cannot be 
used to challenge a previous seronegative test 
result. Unlike seropositivity, seronegativity 
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may not be lifelong. The original test show- 
ing seronegativity may have been accurate, 
even if a test on a sample of blood that was 
drawn later proves positive. The second test 
may simply show that the person became in- 
fected after taking the first test. Only if the 
blood sample used for the first test is avail- 
able for retesting can it be shown that the first 
test was wrong. 


To summarize: 


e afinding of seropositivity could be chal- 
lenged by testing a blood sample drawn 
subsequently. Generally, only in limited 
circumstances (the estate example) 
where a later blood sample is not avail- 
able is the original blood sample neces- 
sary to challenge the original finding. A 
finding of seropositivity as of a past date 
can be confirmed, however, only by 
retesting the sample of blood on which 
the first test was performed. 


e a finding of seronegativity can be chal- — 


lenged only by retesting the sample of 
blood on which the first test was per- 
formed. A test performed on a later 
sample of blood cannot be used to dis- 
pute the original finding of 
seronegativity; it can only confirm the 
original finding and, even then, may not 
always be accurate. (For example, a 
seropositive person may have been mis- 
takenly described as seronegative, but 
could in the meantime have lost an- 
tibodies or ceased producing them). 


At issue is how far government institutions 
must go to facilitate challenges under the 
Privacy Act to information stored in personal 
information banks. Subsection 6(1) of the 
Act reads as follows: 


Personal information that has been used 
by a government institution for an ad- 
ministrative purpose shall be retained by 
the institution for such period of time after 
it is so used as may be prescribed by 
regulation in order to ensure that the in- 
dividual to whom it relates has a 
reasonable opportunity to obtain access to 
the information. 


Subsection 4(1) of the Privacy Regulations 4 
sets out time limits for retaining information: 


Personal information concerning an in- 
dividual that has been used by a govern- 
ment institution for an administrative 
purpose shall be retained by the institution 


(a) for at least two years following the 
last time the personal information was 
used for an administrative purpose un- 
less the individual consents to its dis- 
posal; and 


(b) where a request for access to the 
information has been received, until 
such time as the individual has had the 
opportunity to exercise all his rights 
under the Act. 


The Act and Regulations may be interpreted 
to mean that only the information about HIV 
status is required to be kept (and not the 
actual blood samples). If so, there will be 
little problem in complying with the Act and 
Regulations. The institution will merely 
store information, not blood samples. 


The duty to retain and the right of access, 
however, might be interpreted to require the 
retention of blood samples, and not merely 
the results taken from those samples. 
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This issue presents no small problem. The 
logistics of storing blood samples for at least 
two years probably were not in the minds of 
the drafters of the Privacy Act when such a 
broad definition of personal information was 
included. 


The Privacy Act will probably be interpreted 
to require that only the recorded results need 
be retained, not the original blood samples. 
This would disadvantage those who wished to 
challenge a finding of seronegativity by rely- 
ing on the section 12 "correction" or "nota- 
tion" procedure. Not retaining blood 
samples could also disadvantage a small num- 
ber who wished to challenge seropositive 
findings. 


Without judicial direction to the contrary, it 
would appear reasonable for those few in- 
stitutions that may collect blood samples (for 
example, Health and Welfare Canada and 
Correctional Service Canada) to assume that 
the Act’s information retention periods re- 
late only to any information generated from 
tests performed on the samples. 


Recommendation 14 


In responding to requests to correct the 
results of HIV antibody tests, institutions 
should adopt the following guidelines: 


(1) A record of a seropositive test result 
may be corrected if the physician of the 
person requesting the correction con- 
firms that a subsequent test has been 
performed with a negative result. When 
assessing the request, the institution 
should consider that, ordinarily, 
seropositivity is lifelong; subsequent 
negative test results, if properly con- 
ducted, most likely (although not cer- 
tainly) invalidate the original test 
result. The institution should consider 
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whether repeat testing of the more 
recent blood sample is necessary to sup- 
port the validity of the challenge to the 
original finding. After weighing these 
factors, the institution may change the 
original finding or decide to place a 
notation on the file about the recent 
seronegative test result. 


(2) A record of a seronegative result 
should not be corrected if challenged. 
However, a notation should be added to 
the record indicating that a correction 
was requested and its nature. 


(3) A record of either a seronegative or 
seropositive result must, however, be 
corrected if it was recorded through ad- 
ministrative or clerical error. 


(e) Remedies for Improper 
Practices by Government 
Institutions 


Penalties for the improper handling of AIDS- 
related personal information also figure in 
the discussion. Legislative directions are of 
little value without enforcement 
mechanisms. 


Apart from penalties for obstructing the 
Privacy Commissioner (section 68), the 
Privacy Act imposes no penalties on those 
who breach its provisions. Legislation that 
governs the handling of personal information 
by specific institutions sometimes imposes 
penalties for improper actions. The Criminal 
Code breach of trust provisions can be ap- 
plied where there has been criminal conduct. 
The Government Security Policy issued by 
Treasury Board provides still other sanctions, 
including discharge from employment. Civil 


——e—=eaoa—q@aoe———————————— AIDS and the Privacy Act 


actions may be possible. Finally, the Charter 
of Rights permits a range of (unspecified) 
remedies where its provisions have been 
breached. Section 74 of the Privacy Act, how- 
ever, limits the criminal and civil liability of 
the Crown, government institutions and 
employees of those institutions. Section 74 
protects them from civil or criminal liability 
where personal information is disclosed in 
good faith under the Act. It also protects 
against liability for the consequences that 
flow from the disclosure. 


Except for the Charter and some civil actions, 
penalties and remedial measures tend to be 
applied only for improper use or disclosure. 
There appear to be fewer statutory remedies 
for improper collection of information. 


This plethora of remedies and penalties may 
comfort those who fear that AIDS-related 
personal information will be improperly 
used. Perhaps it should not. Serious 
breaches of security of personal information 
still occur, despite the potential for severe 
penalties, as the 1986-87 Annual Report of 
the Privacy Commissioner chronicles. 


No system of security is perfect. No range of 
penalties will deter everyone from conduct 
that threatens the security of personal infor- 
mation. Accordingly, we return to our earlier 
theme: what is not collected cannot be dis- 
closed improperly or misused. 


Government institutions can also enhance 
the protection given personal information by 
educating their employees about the extreme 
delicacy of AIDS-related personal informa- 
tion. They must be reminded of the conse- 
quences of unauthorized collection, use and 
disclosure, both for the infected person and 
for the employee. Well informed custodians 
of information will not be as likely to be 
reckless. Education, however, may not deter 


those who intend to abuse the information. 
Penalties, strict security procedures and con- 
straints on collection, use and disclosure must 
remain as additional safeguards. 


Sections 35 and 37 give the Privacy Commis- 
sioner the power to make recommendations 
to Ministers for dealing with what the Com- 
missioner considers infringements of the 
Privacy Act. To date, the Privacy Commis- 
sioner has not recommended penalizing er- 
rant employees who breached the collection, 
use and disclosure provisions. Any criminal 
misconduct was pursued through criminal in- 
vestigations. 


Because of the sensitivity of AIDS-related 
personal information, the Privacy Commis- 
sioner will in future consider recommending 
sanctions against public officials who have 
not handled AIDS-related personal informa- 
tion in accordance with the Privacy Act. This 
does not represent a call for the expansion of 
existing powers. It simply means making 
greater use of the powers of recommendation 
afforded by sections 35 and 37. 


In addition, the Privacy Commissioner may, 
under subsection 64(2), disclose to the Attor- 
ney General information relating to the com- 
mission of an offence. 


The Privacy Commissioner will continue to 
have no authority to enforce the recom- 
mended penalties. Enforcement would be 
left to the institution or courts. They could 
act (or not act) on the Privacy 
Commissioner’s recommendations. 


In any event, heads of institutions must accept 
the onerous responsibility placed on them for 
the care and control of such sensitive infor- 
mation. When abuses of AIDS-related per- 
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sonal information occur, it is simply not good 
enough to be apologetic and vow to do better 
in the future. 
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PART IV 


SPECIFIC SITUATIONS 


The recommendations in Part II focus on 
collection, use and disclosure. Many of the 
practical issues arising in government institu- 
tions, however, relate more directly to dis- 
closure. This section examines how the 
disclosure and other principles raised in Part 
III apply to several groups: employees of 
government institutions (not including the 
Canadian Forces), Canadian Forces person- 
nel and civilian DND employees, members of 
the public eligible for special benefits from 
government due to illness or disability, in- 
mates in federal institutions and applicants 
for immigration. 


(a) Public Service 
Employees 


Some may argue that if a public servant (or, 
indeed, any person employed by a govern- 
ment institution) is HIV seropositive, co- 
workers should be permitted to know. They 
advance two justifications for disclosure. 
First, co-workers can take preventive 
measures to avoid contagion. Second, super- 
visors who are aware of an employee’s HIV- 
status can decide what work duties the 
employee should perform. 


We recognize the real (if insupportable) fear 
of contagion through workplace contact. 
Nonetheless, this alone does not justify 
notifying co-workers of a person’s HIV status. 
Educating public servants about mechanisms 
of transmission intrudes far less into the 
privacy of the individual affected. It is also 
more humane. Those who understand the 
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nature of AIDS and HIV infection will be less 
likely to ostracize a person who is already 
undoubtedly suffering from psychological or 
physical trauma. 


Even an infected employee’s superiors need 
not know the person’s condition. A medical 
certificate indicating that the person can or 
cannot perform certain functions should suf- 
fice. Only the person’s physician or a 
physician from Health and Welfare Canada 
would be aware of his or her specific condi- 
tion. 


This medical certificate could also serve 
foreign service personnel and others whose 
work takes them to foreign countries. Some 
concern has been expressed (although there 
is no consensus) that seropositive personnel 
who are posted to certain foreign countries 
may have the onset of AIDS hastened by 
being exposed to a range of foreign viruses 
and bacteria. In addition, inoculating 
symptomatic seropositive personnel with live 
vaccines could create grave health risks. 


An employee about to be posted abroad 
should be informed of the possible risks of 
accepting such assignments and of being 
inoculated if seropositive. The employee 
should then be told that he or she may wish 
to undergo an antibody test before receiving 
inoculations or being posted abroad. 


If the person decides not to be tested, he or 
she assumes the risks to health posed by the 
inoculation or posting. If the person decides 
to be tested, he or she could see a Health and 
Welfare Canada physician or his or her per- 
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sonal physician. There would be no need to 
disclose to a superior that a test has been 
taken or refused. 


If the person decides to be tested and is 
seropositive, the physician could inform the 
employer that the person cannot accept cer- 
tain postings or inoculations for health 
reasons. This process safeguards the privacy 
of the individual. Yet it still addresses the 
concerns of employers about to send 
employees abroad. 


Need has been expressed (particularly by the 
United States government) for a "walking 
blood bank" in some countries. Employees of 
an embassy or High Commission may provide 
bloed for transfusions to other employees 
instead of having them rely on possibly unsafe 
local blood supplies. This may lend weight to 
the call for testing all personnel sent to 
foreign postings. Each person would there- 
fore know whether he or she could safely 
donate blood. 


Still, there is no need here for co-workers or 
superiors to know that the person is seroposi- 
tive or even whether the person has been 
tested. Those wishing to contribute to a walk- 
ing blood bank could be required to be placed 
on an eligibility list. Health and Welfare 
Canada could determine the criteria for 
eligibility and arrange for candidates to be 
tested. No one in a candidate’s department 
would need to know the precise reason why a 
candidate’s name was not on the eligibility 
list. 


Similarly, even where seronegativity may be 
a bona fide occupational requirement, it is 
not necessary that test results be made known 
to the superior of the infected person. A 
medical certificate could simply indicate that 
the person is not to perform such duties. This 
may invite speculation about the reason for 


restricting activities, but will not disclose 
Seropositivity to the person’s superiors. The 
infected person’s physician alone (and per- 
haps Health and Welfare Canada) will pos- 
sess details of the health condition. 


Accordingly, we suggest that in most public 
service employment (even on foreign post- 
ings) there is little, if any, justification for 
providing co-workers or superiors with 
AIDS-related personal information. Be- 
cause this information will then not appear in 
personnel files the danger of information 
leaks is reduced. (Even if the person volun- 
teers the information, it should not be kept 
on file). 


(b) Canadian Forces 
Personnel and Civilian 
Department of National 
Defence Employees 


Rigorous physical activity is often part of the 
military regimen. Consequently, it may be 
argued that AIDS-related personal informa- 
tion has greater relevance to the conditions 
of service in the Canadian Forces than it 
would to more sedentary forms of employ- 
ment. 


At present, only medical personnel and 
senior military authorities (including Com- 
manding Officers) with a need to know are 
made aware of a member’s seropositivity. 
We question whether senior military 
authorities truly need to be informed about 
seropositivity. Is it not sufficient to know that 
a member falls within a medical category that 
will not permit certain types of activity, just as 
could be the case with employees of govern- 
ment institutions in general? We also ask 
whether senior military authorities should be 
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permitted access to other AIDS-related per- 
sonal information. This information could in 
general be handled as we recommend for 
public service employees. 


The Department of National Defence faces 
one particular difficulty. Certifying 
seronegativity of military members and 
civilian employees for training in the United 
States will dictate testing approximately 1000 
members and 200 civilian employees annual- 
ly. This will result in the collection of AIDS- 
related personal information. Above all, it 
will result in the sharing of some of this infor- 
mation with a foreign government. 
American military authorities will not recon- 
sider this testing requirement. 


While it seems relatively innocuous to con- 
firm that a person is seronegative, this sets a 
precedent which concerns us. A foreign 
government has imposed testing require- 
ments when Canada is in no position to 
refuse. We are concerned about the United 
States collecting AIDS-related personal in- 
formation on Canadians, particularly given, 
in our view, the misdirected zeal that 
American authorities have shown for obtain- 
ing and using this type of information. 


Under no circumstances should DND dis- 
close to the United States military authorities 
the names of Canadians being tested. This 
would allow U.S. military authorities to 
speculate that those who did not sub- 
sequently attend training courses in the 
United States had tested seropositive. Only 
the names of those who test seronegative and 
are asked to attend should be passed on. 


Testing of military and civilian personnel, 
where it must be carried out, can be handled 
as follows. Military personnel medical 
records are maintained by the Canadian For- 
ces. The results of antibody tests will there- 
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fore appear on those records. If a Canadian 
Forces member tests positive, a medical cer- 
tificate should be prepared indicating that for 
medical reasons the member cannot par- 
ticipate in the U.S. training program. Again, 
we question whether senior military 
authorities need to know the specific medical 
condition. ; 


With civilian personnel, the situation will dif- 
fer slightly. Antibody test results should be 
maintained by Health and Welfare Canada or 
by a private physician if the employee chooses 
to be tested through the physician. If the 
employee tests positive, a medical certificate 
should be issued indicating that the person 
cannot undergo training for medical reasons. 
There is no need for the certificate to disclose 
the exact medical condition. 


(c) Members of the 
Canadian Public Eligible for 
Special [lIness or Disability 
Benefits from Government 


Many government programs provide benefits 
or concessions to persons with disabilities. 
All these programs cannot be described here. 
The following suggestions are aimed at limit- 
ing the unnecessary collection of AIDS-re- 
lated personal information. 


There should be a review of programs that 
require a statement of medical disability to 
determine whether a general statement will 
suffice. Is it truly necessary for a person to 
divulge the intimate details of a medical con- 
dition to obtain a benefit or concession under 
a government program? 
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Unemployment insurance provides one com- 
mon example of a program that benefits those 
who are ill. The Unemployment Insurance 
Act permits benefits to be paid to un- 
employed workers. Under section 14 of the 
Act, however, a claimant is not entitled to be 
paid "initial benefit" for any working day in a 
benefit period for which he fails to prove that 
he was "incapable of work by reason of 
prescribed illness, injury or quarantine". 


Subsection 47(1) of the Unemployment In- 
surance Regulations requires a person alleg- 
ing that he is ill to furnish a medical certificate 
to the Unemployment Insurance Commis- 
sion. The certificate must supply such infor- 
mation as the Commission may require "with 
respect to the nature of the illness ...". 


In addition, subsection 47(2) permits the 
Commission to require the claimant to un- 
dergo another (independent) medical ex- 
amination to determine the nature of the 


illness, and other matters, such as the prob- 


able duration of the incapacity. 


The disclosure of detailed medical informa- 
tion to the Commission may be unnecessary. 
Section 47 of the Regulations does not com- 
pel the Commission to obtain details of a 
medical condition. It has a discretion to do 
so. It would not violate the Act or Regula- 
tions to accept a physician’s certificate that 
does not specify the nature of the illness. 


Some may argue that details of illnesses are 
necessary to prevent a claimant from relying 
on a "friendly" physician to warrant inability 
to work, or to extend the period of incapacity. 
If this is the fear of the Commission, it could 
offer a claimant two choices: 


(1) supply a detailed medical opinion 
from the claimant’s own physician (this 
would disclose HIV infection), or 


(2) Gf the claimant wants the precise 
condition kept from the Commission) 
send the claimant to a physician ap- 
proved by the Commission; this 
physician will operate under Commis- 
sion guidelines detailing acceptable ill- 
nesses and times off work. If the 
claimant has AIDS, the physician would 
report a medical illness and estimate its 
term. The Commission would accept 
the certificate of the physician without 
knowing the details of the illness. 


Variations on this theme might be applied 
elsewhere in government. Less AIDS-re- 
lated personal information about claimants 
will then be stored in an institution’s personal 
information banks. 


We acknowledge, however, that some 
government institutions must collect detailed 
medical information because legislation, 
judicial pronouncement or policy compel 
them to. These must be obeyed. However, 
their impact can be softened by ensuring ade- 
quate security of records and adopting 
reasonable information disposal schedules. 


In the long term, legislation, judicial 
pronouncements and government policies 
can be changed. If the protection of AIDS- 
related personal information is considered 
important, revisions to policy and legislation 
are appropriate long term options. 


(d) Inmates in Federal 
Correctional Institutions 

and Correctional Staff 

Inmates pose special problems. Like few 


other groups in Canadian society, their daily 
activities are strictly controlled by a govern- 
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ment institution. With that extraordinary de- 
gree of control comes an extraordinary 
responsibility for inmate welfare. 


This has implications for the treatment of 
AIDS-related personal information. A diag- 
nosis of HIV infection is to be noted on the 
inmate’s medical record. 


Commissioners’ Directive 821 provides for 
release of information relating to HIV status 
to "agency/supervisory staff" without the 
inmate’s consent if there is cause to believe 
that the inmate’s actions may constitute a 
danger to himself or others. Health care staff 
may then, "in accordance with the Privacy 
Act", provide information to the appropriate 
personnel without the inmate’s consent. 


Should incarceration diminish the rights of an 
inmate to maintain AIDS-related personal 
information in confidence? With other 
groups, such as public servants, we have sug- 
gested that supervisors normally need not be 
informed of a person’s HIV status. 


Nonetheless, there may be merit in a policy 
that allows disclosure where an infected 
inmate’s conduct threatens others (for ex- 
ample, through unsafe sexual practices or the 
sharing of needles). This policy may even be 
necessary because prison policy dictates that 
no condoms will be issued to inmates. The 
likelihood of needles being issued is even 
more remote, as it might be seen as condon- 
ing drug use in prisons. Even educating in- 
mates about the dangers of unprotected 
intercourse or the sharing of needles may not 
reduce risky conduct, as the means they need 
to reduce the risk (condoms and needles) are 
not available to them. 


We anticipate that risky conduct will continue 


in prisons because prison policies will not 
reduce risk by allowing condoms and needles. 
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It may be necessary therefore to protect in- 
mates by warning them away from infected 
inmates who engage in risky activities. This 
will seriously compromise the privacy of in- 
fected inmates and may endanger their physi- 
cal safety. But it may be one of only a limited 
number of actions available to protect other 
inmates. 


One other possibility is to segregate an in- 
fected inmate who does not stop dangerous 
conduct. It would then not be necessary to 
disclose the grounds for segregation to other 
inmates. Before an inmate’s infected status 
is made known to other inmates, however, he 
should be asked whether he prefers to be 
segregated from other prisoners (while keep- 
ing his HIV infection confidential) or 
whether he wishes to remain in the general 
population (which will then be told of his 
status and warned to avoid risky behaviour 
with him). This is an unpalatable choice. But 
it may be forced on the inmate given current 
prison policies about condoms and needles. 


Whether corrections officers and others ad- 
ministering prison facilities need to know the 
HIV status of inmates remains a question. 
Corrections officers may pass the informa- 
tion negligently to other inmates. At the 
same time, some corrections officers may fear 
that inmates will attempt to infect them, given 
the hostile relations between the two groups. 
How significant a risk this is must be assessed 
before a decision is made about informing 
corrections officers of an inmate’s HIV infec- 
tion. 
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(e) Applicants for 
Immigration 


The health criteria for admissibility of im- 
migrants are determined by Health and Wel- 
fare Canada. At present, immigrants with 
AIDS are inadmissible, as are those who are 
identified as HIV seropositive. 


Health and Welfare Canada does not indicate 
to Employment and Immigration the precise 
medical grounds for refusing to allow an ap- 
plicant to immigrate. It merely certifies that 
the applicant is medically unfit. This proce- 
dure seems appropriate to us. It protects 
against the broad dissemination of HIV status 
information by holding the information in 
Health and Welfare Canada data banks. 


Should an applicant for immigration be 
rejected, the sponsors have a right to know 
the grounds for the rejection, including any 
relevant medical condition (see Appendix 


III). While the applicant should be made | 


aware of this justification for refusal, we ques- 
tion whether sponsors should be informed. 


This represents one of the few situations we 
have encountered where AIDS-related per- 
sonal information about one person is dis- 
closed by government to someone outside 
government. An applicant sponsored by 
parents or relatives may not want them to 
learn of any HIV infection because, for ex- 
ample, it may reveal sexual practices or drug 
use. The applicant may fear that they will 
disclose it to others. Unlike the situation in 
which AIDS-related personal information is 
disclosed within government, the Privacy Act 
places no controls on what sponsors do with 
the information. 


Yet the information may be important for 
sponsors who want to appeal a refusal to 
allow entry. They might, for example, chal- 
lenge the reliability of an HIV antibody test 
that was taken in a Third World country. If 
they did not know the reason for the refusal, 
they would not know how to frame the chal- 
lenge. 


One possible solution is to allow disclosure of 
AIDS-related personal information to spon- 
sors only with the consent of the applicant. 
EIC confirms that this is in fact done at 
present. The applicant is asked to consent to 
the release of medical information to rela- 
tives in Canada. But legislation and 
jurisprudence seem to require that family 
sponsors be made aware of the reasons for 
refusal. Perhaps a legislative amendment is 
needed. It would clearly give a sponsored 
applicant the right to refuse the release of 
medical information, even to family mem- 
bers, without prejudicing the immigration ap- 
plication. 
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PART V 


SUMMARY OF RECOMMENDATIONS 


Recommendation I 


Treasury Board take steps to issue a com- 
prehensive policy on AIDS in the workplace; 
this policy should include a clear statement 
on confidentiality and the controls on the 
collection of AIDS-related personal informa- 
tion, guided by the principles and recommen- 
dations set forth in this report. 


Recommendation 2 


AIDS-related personal information avail- 
able through voluntary testing, the volun- 
tary provision of information, or both, 
should be collected only where the collection 
is a necessary element of the administration 
of a statutorily mandated program or ac- 
tivity of the institution. 


Recommendation 3 


No compulsory or mandatory HIV antibody 
testing should be implemented by govern- 
ment institutions unless specifically 
authorized by statute. Moreover, existing 
enabling provisions, such as section 7 of the 
Financial Administration Act, which do not 
specifically address the collection of AIDS- 
related personal information, should not be 
relied on to authorize such collections. 


Recommendation 4 


Further study should be undertaken to 
determine whether, to what extent and under 
what safeguards, DND should collect AIDS- 
related personal information concerning 
Canadian Forces members. 
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Recommendation 5 


Wherever possible, AIDS-related personal 
information should be collected directly 
from the person affected, and not by consult- 
ing records or a third party (except where the 
individual authorizes otherwise or where 
personal information may be disclosed 
under subsection 8(2)), and 


Wherever possible, when collecting AIDS-re- 
lated personal information, including collec- 
tion from records or a third party, the 
institution should inform the person to 
whom the information relates of the purpose 
of the collection and the source of the collec- 
tion. 


Recommendation 6 


AIDS-related personal information should 
be used only as follows: 


i) for the purpose for which the informa- 
tion was compiled or obtained by the 
institution, 


ii) for a use consistent with that pur- 
pose, or 


iil) for a purpose for which the informa- 
tion may be disclosed under subsection 
8(2). 


In situation ii), no use should be undertaken 
without the approval of the head of the 
government institution. In situation iii), no 
use should be undertaken under paragraphs 
8(2)(e) to (m) without the approval of the 
head of the government institution. 
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Recommendation 7 


To meet the requirements of subsection 6(2), 
a record of a finding of seropositivity on the 
basis of screening testing only should never 
be used for an administrative purpose. Only 
a seropositive result after a confirmatory test 
should be used for an administrative pur- 
pose. 


Arecord ofa medical opinion suggesting that 
a person has symptomatic HIV infection may 
be used for an administrative purpose, even 
without HIV antibody tests being performed. 
However, only a confirmatory test result 
should be used to confirm seropositivity. 


Recommendation 8 


To meet the requirements of subsection 6(2), 
a finding of seronegativity based on a single 
screening test performed under appropriate 
laboratory conditions should be considered 
"as accurate as possible" and might be relied 
on for an administrative purpose. Nonethe- 


less, those using the information for an ad-— 


ministrative purpose should be made aware 
of the deficiencies inherent in any finding of 
seronegativity. 


Recommendation 9 


The following policy should govern dis- 
closures of AIDS-related personal informa- 
tion: 


No disclosure of AIDS-related personal in- 
formation should be made to third parties 
under paragraphs 8(2)(e) to (m) without 
first seeking to obtain consent from the in- 
dividual for the release. There would be no 
need to seek consent before disclosing this 
information under paragraphs 8(2)(a) to 


(d). 


Where consent to disclose is not given, no 
disclosure should be made to third parties 
under paragraphs 8(2)(e) to (m) without the 
approval of the head of the institution. This 
approval would not be required for dis- 
closures under paragraphs 8(2)(a) to (d). 


In exercising discretion to disclose under 
subsection 8(2)(e) to (m) the head of the 
institution should review 


(1) why disclosure is necessary 


(2) the potential adverse consequences 
of the disclosure on the individual(s) to 
whom it relates, 


(3) the likelihood that the requestor can 
and will maintain the confidentiality of 
the information and 


(4) the likelihood that the requestor will 
use it only for the purpose for which it 
was originally sought. 


Where a third party requests disclosure of 
AIDS-related personal information under 
paragraphs 8(2)(e) to (m), the onus should 
be placed on the requestor to justify the dis- 
closure of the information. 


Recommendation 10 


AIDS-related personal information should 
be disclosed to provincial governments or 
their agencies only under paragraph 8(2)(f) 
agreements, except in rare cases where the 
public interest calls for disclosure without an 
agreement being in place. 


Existing federal/provincial information 
sharing agreements should be reviewed to 
determine whether the sharing of AIDS-re- 
lated personal information with provincial 
health authorities is covered. 
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No information should be disclosed pur- 
suant to paragraph 8(2)(f) agreements un- 
less the conditions contained in 
Recommendation 9 are also met. 


Recommendation 11 


A federal government institution should or- 
dinarily accept AIDS-related personal infor- 
mation from a provincial government 
institution only where the providing institu- 
tion agrees that the information may be 
processed in accordance with the Privacy Act 
as if it were federal information. 


Exceptions to this general rule should be 
permitted where it is necessary for in- 
dividual or public safety or where it is essen- 
tial to the operational effectiveness of a 
statutory program. 


Recommendation 12 


The head of a government institution should 
refuse under section 28 to disclose AIDS-re- 
lated personal information requested under 
subsection 12(1) only in rare circumstances. 
The refusal should be supported by the 
opinion of a qualified medical practitioner. 
The person requesting the information must 
be told of the right to complain to the Privacy 
Commissioner about the refusal. 


Recommendation 13 


Section 25 should not be relied on to refuse 
disclosure of AIDS-related personal infor- 
mation unless 


(1) there is some objective evidence in- 


dicating that the safety of individuals 
could be threatened, and 
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(2) the person requesting the informa- 
tion does not have independent 
knowledge of the requested informa- 
tion. 


Recommendation 14 


In responding to requests to correct the 
results of HIV antibody tests, institutions 
should adopt the following guidelines: 


(1) A record of a seropositive test result 
may be corrected if the physician of the 
person requesting the correction con- 
firms that a subsequent test has been 
performed with a negative result. When 
assessing the request, the institution 
should consider that, ordinarily, 
seropositivity is lifelong; subsequent 
negative test results, if properly con- 
ducted, most likely (although not cer- 
tainly) invalidate the original test 
result. The institution should consider 
whether repeat testing of the more 
recent blood sample is necessary to sup- 
port the validity of the challenge to the 
original finding. After weighing these 
factors, the institution may change the 
original finding or decide to place a 
notation on the file about the recent 
seronegative test result. 


(2) A record of a seronegative result 
should not be corrected if challenged. 
However, a notation should be added to 
the record indicating that a correction 
was requested and its nature. 


(3) A record of either a seronegative or 
seropositive result must, however, be 
corrected if it was recorded through ad- 
ministrative or clerical error. 
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Appendix I 


AIDS - ITS CHARACTERISTICS 


(a) General 


AIDS stands for Acquired Immunodeficien- 
cy Syndrome. AIDS is caused by a virus 
called HIV (Human Immunodeficiency 
Virus). The HIV (or, colloquially, the 
"AIDS" virus) attacks and seriously disrupts 
the body’s immune system, its defence 
against disease. 


The syndrome leading to AIDS is divided into 
stages: 


e infection with the HIV 


e asymptomatic (no overt symptoms) car- 
rier state 


e development of symptomatic HIV in-- 


fection, (also called AIDS Related 
Complex, or "ARC") 


e development of AIDS. 


AIDS is properly the name given only to the 
last of these stages. Here, the breakdown in 
the immune system leaves the body vul- 
nerable to life-threatening infections and 
cancers. These diseases, not the destruction 
of the immune system as such, eventually 
result in death. At present, contracting AIDS 
always leads to death. Medical treatments 
may delay death, make persons with AIDS 
("PWA’s") more comfortable, or both. 


AIDS may not develop in a person for several 
years after he or she becomes infected with 
the virus. It may not develop at all. It is not 
yet known whether every person infected 


with the HIV will eventually develop AIDS. 
Based on observations to date, Canada’s 
Federal Centre for AIDS suggests that ap- 
proximately 35-50 per cent of infected per- 
sons will develop AIDS within seven years of 
infection. Over time, an even greater per- 
centage may develop the disease. 


The New York Times’ reported one study of 
155 infected homosexual and bisexual men in 
San Francisco. Their approximate date of 
infection was known. Very few developed 
AIDS in the first two years after infection. 
Five per cent had developed AIDS after three 
years, 10 per cent after four years, 15 per cent 
after five years, and 24 per cent after six years. 


After seven years and four months, 36 per 
cent had developed AIDS. An additional 40 
per cent showed other signs of infection, such 
as severe weight loss, prolonged fever or oral 
fungi. Only one in five remained free of 
symptoms. 


Dr. Anthony Fauci, Director of the National 
Institute of Allergy and Infectious Diseases 
(of the United States), has asked: "Will vir- 
tually everyone who is infected develop full- 
fledged AIDS after 35 or 40 years? Or will it 
plateau at 35 to 40 per cent?" 


Dr. Fauci recently told the President’s AIDS 
Commission that evidence from the Walter 
Reed Army Medical Centre suggests that 80 
to 90 per cent of all infected individuals ex- 
perience some level of deterioration in their 
immune systems over a few years, suggesting 
that the vast majority of them will be adver- 
sely affected over time. * 
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Even if a person infected with the HIV does 
not develop AIDS, it is accepted that he or 
she is probably capable of transmitting the 
virus for life. As well, it is assumed that the 
presence of the antibodies to the HIV indi- 
cate the continuing presence of the HIV it- 
self. 


A cure for AIDS or a vaccine to protect 
against it may not be available for several 
years, if at all. Estimates of the time required 
to develop such remedies vary widely, but are 
almost always stated in years. Some suggest 
that a cure may be impossible. 


(b) Methods of Transmission 


Public fear of AIDS and calls for radical 
responses (such as publicizing the names of 
infected persons or placing them in quaran- 
tine) stem largely from not knowing how 
AIDS is spread. 


The HIV may be present in blood, semen and 
vaginal fluid of a person infected with the 
virus. The virus is transmitted in several 
ways: 


e Through sexual activity. In Canada, this 
is the most frequent means of transmis- 
sion. The virus can be transmitted from 
an infected person to his or her sexual 
partner (man to woman, woman to man, 
and man to man); 


e Through blood or blood products. The 
main ways a person can become infected 
are through receiving blood transfusions 
(or blood products) infected with the 
HIV or by using blood-contaminated 
needles or other skin-piercing equip- 
ment; 


46 - Appendix I 


e From infected mother to child during 
pregnancy, at or about the time of birth, 
and possibly from breast milk; 


e From sperm, tissue, breast milk or solid 
organ donations from an infected donor. 


AIDS is not highly contagious. Medical and 
scientific opinion accepts that AIDS is NOT 
spread through casual contact, such as occurs 
at work or at school; touching or hugging; 
handshakes; coughing or sneezing; insects; 
water or food; cups, glasses, plates; toilets; 
using communal swimming pools or public 
baths; using communal dining facilities; or 
using communal dormitories. The normal 
mixing and mingling of infected persons with 
others therefore carries no danger. 


While the HIV has occasionally been 
detected in low concentrations in body fluids 
such as saliva, urine and tears, there is no 
evidence that these fluids have caused infec- 
tion. The virus is not spread by the airborne 
route. 


The Statistical Picture 
(a) International 


AIDS was first identified as a disease in 1981, 
although the widespread epidemic of infec- 
tion probably started in the mid-1960s.° 
Since then it has been reported in over 160 
countries. 


Recent (1987 and 1988) reports from 
countries and international statistics as- 
sembled by the Federal Centre for AIDS in- 
dicate a total of 127,611 cases of AIDS 
world-wide. 
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This figure is almost certain to be an under- 
estimate. Barriers to diagnosis, recognition 
and reporting of the disease exist throughout 
the world. Even in the United States, with a 
highly developed AIDS surveillance net- 
work, an estimated 10 per cent of AIDS cases 
are not reported to government. In some 
countries, particularly developing countries 
which may lack the tools to make a firm diag- 
nosis, the reported number of cases may be 
only a fraction of the total. Furthermore, 
some countries may be reluctant for political 
reasons (such as a fear of losing tourist trade) 
to report a high incidence of AIDS. 


The World Health Organization (WHO) in 
1988 estimated that about 250,000 cases of 
AIDS have occurred since the beginning of 
the epidemic.’ 


The January 3, 1989, report from the Federal 
Centre for AIDS show that Canada had a 
cumulative (that is, since 1979) rate of 90 


cases of AIDS per million population. In 


figures from the same general period (1988) 
from the United States, the cumulative rate 
was significantly higher, at 317.5 per million. 
Denmark reported a rate of 62.5 per million. 
The United Kingdom reported 31.6 per mil- 
lion and France reported 76.6 per million.® 


There is no way to determine accurately the 
number of persons who have been infected by 
the HIV. WHO broadly estimates the num- 
ber to be between 5 and 10 million. AI- 
though, as stated above, there is debate over 
what percentage will eventually develop 
AIDS, WHO in 1987 accepted a figure of 
between 10 per cent and 30 per cent. If these 
broad estimates hold true, there will be from 
10 to 30 times more AIDS cases in the next 
five years than in the past five years.’ 


(b) Canada” 


As of January 3, 1989, the Federal Centre for 
AIDS had received reports of 2323 cases of 
AIDS. All occurred since 1979. Adults ac- 
counted for 2284 cases, (2166 men and 118 
women); 39 were children less than 15 years 
old (18 males and 21 females). Of this total, 
1259 deaths have been reported. 


The number of reported cases of AIDS in 
Canada doubled in the seventeen months 
prior to January 3, 1989. 


The Federal Centre for AIDS Surveillance 
Update: AIDS in Canada reports projections 
of the number of new cases of AIDS that will 
occur between 1988 and 1992. Two empirical 
modelling techniques were used to arrive at 
the projections - the logistic model and the 
polynomial model. 


The logistic model estimates that the number 
of new cases reported annually will remain 
almost constant from 1987 to 1991. It 
predicted 562 new cases in 1987 (in fact, there 
were 684, and more will be reported over 
time) and predicts 1036 new cases in 1992. 
Using this model, a total of 6849 AIDS cases 
will have occurred in Canada between 1979 
and the end of 1992. The model predicts the 
growth rate in AIDS cases will plateau early 
in the 1990’s. 


The polynomial model estimates a substan- 
tial increase in new cases over the next several 
years. It predicted 653 new cases in 1987, 
with the number of cases rising each succes- 
sive year. The model predicts 2656 new cases 
in 1992, for a cumulative total of 10,842 be- 
tween 1979 and the end of 1992. This model 
does not predict a levelling off of new cases 
by the end of the prediction period (1992). 
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The Federal Centre for AIDS accepts the 
polynomial model as more likely than the 
logistic model to predict accurately the 
spread of AIDS in Canada over the next 
several years. 


Both models may be affected by changes in 
the dynamics of the spread of infection. For 
example, if intravenous drug use becomes a 
major mechanism for transmitting AIDS in 
Canada (as it has in the United States and 
several other western countries), 
heterosexual AIDS cases may increase sub- 
stantially. 


The Federal Centre for AIDS estimates that 
there are 30 - 50 infected persons in Canada 
for every person with AIDS. The Royal 
Society of Canada suggested early in 1988 
that approximately 30,000 Canadians were 
then infected, although this estimate was 
general at best. The number may be as low 
as 10,000 or as high as 100,000. *° 


(i) Risk groups 


By far the largest number of AIDS cases in 
Canada have occurred in adult males (2166 
cases to date). Among adult males there are 
several identified risk groups. 


According to statistics supplied by the 
Federal Centre for AIDS as of January 3, 
1989, the principal risk factor for AIDS in 
adult males was homosexual or bisexual ac- 
tivity (86 per cent of adult male cases). Less 
than 1 per cent of adult male cases involved 
intravenous drug use alone. Just under 3 per 
cent involved both intravenous drug use and 
homosexual or bisexual activity. Male 
recipients of blood or blood products ac- 
counted for-3.9 per cent sof cases. 
Heterosexual contact with a person at risk of 
contacting AIDS accounted for 1 per cent of 
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the cases. Heterosexual males originating 
from an AIDS-endemic area accounted for 
3.2 per cent of the cases. In 2.5 per cent of 
adult male cases, there were no identified risk 
factors. 


The male age group most heavily affected is 
30 - 39. Over 45 per cent of adult males with 
AIDS fall into this age group. 


The number of AIDS cases in adult females 
is considerably smaller - only 118 to date. Of 
these, 2.5 per cent involved intravenous drug 
use. Recipients of blood or blood products 
accounted for 28 per cent of the total. 
Females originating from an endemic area 
accounted for 31.4 per cent of cases. Sexual 
activity with a male at risk accounted for 32.2 
per cent of cases. No identified risk factors 
were present in 5.9 per cent of adult female 
cases. 


To date, 33.1 per cent of reported adult 
female AIDS cases have occurred in the 20 - 
29 age group. A slightly lower percentage 
(30.5 per cent) have occurred in the 30 - 39 
age group. 


Among pediatric cases of both sexes, perina- 
tal (from mother to child) transmission ac- 
counted for 84.6 per cent of the 39 cases. 
Receiving infected blood or blood products 
accounted for the remainder. Over 80 per 
cent of pediatric cases have occurred in 
children under five. 


(ii) Deaths from AIDS and 
Other Causes 


The Royal Society of Canada reports that in 
1985 AIDS ranked tenth as a cause of death 
among Canadian men aged 25 - 44. '' Ahead 
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on the list were causes such as suicide, motor 
vehicle accidents, coronary disease, stroke 
and cirrhosis. 


Preliminary data for 1986 indicate that AIDS 
moved to fourth place that year. The Royal 
Society report continues: 


If current epidemiological trends 
remain constant, AIDS will surpass 
coronary heart disease to become the 
third leading cause of death for men in 
this age group and by 1992 could even 
become the leading cause of death. 


Nonetheless, AIDS ranks far behind several 
other causes of death in the population as a 
whole. The following chart compares deaths 


from AIDS with those from cancer ("malig- 
nant neoplasms"), heart disease and motor 
vehicle accidents. The chart totals deaths for 
both sexes and covers all age groups. 


It may be argued that this chart is largely 
irrelevant. It does not differentiate death 
rates among age groups. Still, it shows the 
relative scope of the problem (in absolute 
numbers) for Canada as a whole. 


The social and economic consequences of 
AIDS, however, may differ substantially from 
those associated with many other diseases. 
These are discussed briefly below under the 
heading "Direct and Indirect Costs As- 
sociated with AIDS". 


CAUSE OF DEATH 
YEAR AIDS* CANCER HEART DISEASE MOTOR VEHICLE 
1982 22 41,964 Beha, 4,232 
1983 il 42,865 58,446 4,334 
1984 126 44,784 58,215 4,133 
1985 329 46,333 58,331 4,234 
1986 507 Not Avail. N/A N/A 
1987 G27 N/A N/A N/A 
1988 2) N/A N/A N/A 


Sources: Federal Centre For AIDS, Surveillance Update: AIDS in Canada, January 3, 1989 (AIDS 
Statistics only); Statistics Canada, Mortality Summary List of Causes (Vital Statistics Catalogue 
84-206). *To be technically correct, AIDS does not kill. Opportunistic diseases arising because 
of AIDS kill. Note as well that the AIDS statistics for recent years may increase later due to the 


late receipt of confirmed diagnoses of AIDS. 
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(iii) Regional Variations 


British Columbia reports the highest rate of 
cumulative (since 1979) AIDS cases per 
capita in Canada. As of January 3, 1989, B.C. 
reported 158.1 cases (cumulative) per million 
population. Quebec followed, with 105.7 per 
million. Ontario stood third, with 98.9 per 
million. Alberta reported 51.4 cases per mil- 
lion, Nova Scotia reported 37.1 and Yukon 
reported 43.1. Other provinces and ter- 
ritories reported under 30 cases per million. 
The national average as of January 3, 1989, 
stood at 90 cases per million. 


(iv) Direct and Indirect Costs 
Associated with AIDS 


The Royal Society of Canada estimates that 
HIV-related health care expenditures in 1987 
were the equivalent of 0.3 per cent of 
Canada’s total health care expenditures in 
1985 (1985 was the most recent year for which 
comprehensive statistics on health care ex- 
penditures were available). In 1985, private 
and government health care expenditures 
totalled $39.2 billion and comprised 8.5 per 
cent of Canada’s gross domestic product 
(GDP). ® 


Direct costs -- those incurred in the treatment 
and prevention of AIDS and HIV infection -- 
totalled approximately $129 Million in 
1987." 


Indirect costs consist of an estimate of the 
value of the loss when a person dies prema- 
turely. A component of these costs is the 
economic loss to society of a person’s produc- 
tive capacity. Because AIDS affects a rela- 
tively young segment of Canadian society, 
those who die might otherwise have con- 
tributed energetically to the economy. In- 
stead, society has expended resources on 
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them (for example, for their education) only 
to see them die before they can fully return 
their contribution. 


The indirect costs of HIV infection in 1987 
were estimated at between $150 million and 
$350 million. That amounted to between 0.3 
per cent and 0.6 per cent of Canada’s GDP. 


Another (unquantifiable) cost lies in the 
energies that must be devoted to new legal 
and ethical issues relating to AIDS, and to 
research. This report examines only a narrow 
range of those issues -- those associated with 
privacy. An incomplete list of other issues 
that society will be forced to consider in- 
cludes the following: allocation of scarce 
health care resources to infected persons, 
rights of infected workers versus rights of 
their co-workers and employers, protection 
of infected persons against discrimination, 
controlling the spread of HIV infection 
through quarantine or criminal or civil 
measures, the ethics of medical experimenta- 
tion, and restrictions on employment, travel 
and immigration. 


Addressing these issues will consume money 
and time. None are easy to resolve. They will 
cause debate, misunderstandings and ill-feel- 
ing. Providing an intelligent and humane 
response to these issues will challenge 
politicians, government officials and interest 
groups for considerable periods of time. 


The final (and, again, unquantifiable) cost 
associated with AIDS is the human suffering 
that it has caused and will continue to cause. 
Death of a family member after a full life, 
while still creating a profound sense of loss, is 
accepted as normal in the cycle of life in the 
developed world. But there is little normalcy 
in parents burying an adult or infant child who 
dies of an AIDS-related illness. 
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Appendix II 


CURRENT CONTROLS ON COLLECTION, USE AND DISCLOSURE OF 
AIDS- RELATED PERSONAL INFORMATION 


(a) General 


This appendix briefly examines laws relating 
to the collection, use and disclosure of AIDS- 
related personal information. Although this 
report focusses on how the Privacy Act treats 
this information, it is useful to understand 
how provinces and other jurisdictions handle 
similar information. 


This appendix describes in general selected 
provincial health legislation relating to 
AIDS. It then reviews the provisions of the 
Privacy Act and several other federal statutes 
that impose restrictions on the collection, use 
and disclosure of information. It also discus- 
ses the range of remedies available where 
legislation or policy on collection, use and 
disclosure are violated. 


(b) Reporting AIDS or HIV 
Infection 


i) In the Provinces 


In every province and territory, AIDS is 
reportable to health authorities. Infection 
with HIV is reportable in seven of ten provin- 
ces. Not only physicians are required to 
report, but also others involved in health care. 
Physicians are generally involved in diagnos- 
ing and reporting cases of AIDS. 
Laboratories are usually involved in report- 
ing Seropositivity. Sometimes the reporting 
requirement falls on any person who knows 


52 - Appendix II 


or suspects that another is infected or has 
AIDS. Often the infected person’s name 
must be reported. 


What is important is the great extent to which 
reporting of AIDS or infection with HIV is 
required under provincial law. Confiden- 
tiality provisions do exist in many provinces 
to protect some forms of AIDS-related per- 
sonal information. Nonetheless, the poten- 
tial for breaches of confidentiality must be 
recognized wherever legislation requires 
nominal reporting. 


Because of the breadth of nominal reporting 
requirements, provincial laws and policies 
may create privacy concerns of even greater 
magnitude than those created by federal laws 
and policies. In fact, concerns about con- 
fidentiality are frequently directed at provin- 
cial governments. They seem to be much less 
often directed at the federal government. 


Provincial rules on AIDS-related personal 
information nonetheless provide a context 
for examining the treatment of similar infor- 
mation at the federal level. Provincial 
reporting requirements also serve to em- 
phasize that, whatever is done at the federal 
level, the provinces have already "let the cat 
out of the bag". Systematic collection of 
AIDS-related personal information takes 
place across Canada and will continue to do 
SO, nO matter what course of action federal 
government institutions pursue. 
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The following outlines the major tenets of 
provincial legislation requiring the reporting 
of AIDS, ARC or HIV infection. Every at- 
tempt has been made to ensure that the sum- 
maries of the legislation are accurate. The 
legislation is more extensive than the parts 
excerpted here, however, and legislation in 
this area is changing rapidly. The reader 
should therefore refer directly to the legisla- 
tion for full details. 


Alberta: 


The Public Health Act permits the making of 
regulations requiring the reporting to the 
local provincial board by a physician of every 
person under his treatment for any com- 
municable disease or any disease dangerous 
to public health '. Under the Communicable 
Diseases Regulation, * occurrences of AIDS 
are reportable by all sources to the medical 
officer of health within 48 hours. Sections 32 
to 37 of the Act impose similar reporting 


requirements. In certain instances, subsec- 


tion 63(2) of the Act permits the Director 
appointed under the Act to require the name 
and address of a person with AIDS to be 
reported. 


British Columbia: 


Regulations made under the Health Act? im- 
pose broad reporting requirements. 


The Health Act Communicable Disease 
Regulation * lists AIDS as a reportable com- 
municable disease and sets out several 
reporting protocols. Subsection 2(1) re- 
quires anyone who knows or suspects that a 
person is suffering from or has died from a 
communicable disease to report this to a 
medical officer of health without delay. The 
regulation does not specify in this instance 
what identifying information must be 
reported. 


Subsections 2(2) and 2(3) require physicians 
and persons in charge of laboratories to make 
a report that complies with section 4 of the 
Regulation. In addition, section 3 requires 
the administrator or other person in charge 
of a hospital to report to the medical officer 
of health a patient who has been admitted to 
the hospital with a reportable communicable 
disease. 


The information to be reported varies ac- 
cording to who is reporting. In every case 
involving a physician or person in charge of 
laboratory or hospital, section 4 requires at 
least the name and address of the infected 
person. 


Manitoba: 


Manitoba Regulation P210-R2, amendment, 
lists AIDS as a sexually transmitted disease 
and sets out reporting requirements. Subsec- 
tion 40(1) requires a physician to report 
AIDS cases to the Director of Communicable 
Disease Control using a notification form set 
out in the Regulation. The wording of the 
Regulation does not itself require the 
physician to report the name of the person he 
or she attends. Nonetheless, the notification 
form provides space for the patient’s name, 
address, date of birth and other personal in- 
formation. 


Paragraph 44(e) requires a person in charge 
of a laboratory to report all positive results of 
a serologic test for the presence of antibodies 
or positive results of the laboratory iden- 
tification of the HIV. Here, the Regulation 
appears to impose no obligation to report the 
name or other personal details about the in- 
fected person. 
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New Brunswick: 


New Brunswick Regulation 86-66 adds AIDS, 
ARC and any confirmed HTLV-II virus an- 
tibody reactive status to the list of notifiable 
diseases listed in subsection 96(1) of the 
Regulation. Subsection 96(2) sets out 
reporting requirements: 


Where any physician, nurse, 
householder or other person recognizes 
or suspects the presence of any notifi- 
able disease listed in subsection (1), a 
notification shall be sent to the district 
medical health officer or the nearest 
public health inspector who shall imme- 
diately notify the district medical health 
officer. 


Subsection 96(3) requires that the notifica- 
tion contain the name of the person infected 
or suspected to be infected, the place of 
residence and the name of the disease, if 
known. Subsection 99(2) requires a physician 
to report within 24 hours a notifiable disease 
which occurs in any patient under medical 
care. 


Newfoundland: 


Newfoundland Regulation 60/87 adds AIDS, 
ARC and HIV antibody positivity by confir- 
matory testing to the Schedule to the Com- 
municable Diseases Act °. Subsection 4(1) of 
the Act sets out the following reporting re- 
quirements for physicians: 


Whenever any physician knows, or has 
reason to believe, that any person is in- 
fected with any communicable disease 
he shall within twenty-four hours give 
notice thereof to the Deputy Minister of 
Health, or to the health officer in whose 
jurisdiction such person is, and to the 
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hotel-keeper, keeper of a boarding 
house or tenant within whose house or 
rooms such person resides. 


Besides being obliged to report to medical 
health authorities, the physician is obliged to 
report to those in charge of the accommoda- 
tion where the infected person resides. 


Subsection 4(2) requires the physician, where 
possible, to state the name of the disease, the 
name, age and sex of the person, and the 
address of the person. 


Subsection 5(1) requires several other classes 
of people to report communicable diseases to 
the Deputy Minister of Health. The classes 
include the manager or recognized official 
head in charge of any hospital or residential 
institution, or any teacher who knows or has 
reason to believe that a person has a com- 
municable disease. The report must contain 
the name of the person with the disease, and 
information to permit the person to be lo- 
cated. 


Nova Scotia: 


Nova Scotia Regulation 171/85 adds to the list 
of communicable diseases listed in the 
Regulations in Respect of Communicable Dis- 
eases made under the Health Act.’ The list 
now includes the following: 


(15A) Acquired immune deficiency 
syndrome (known as AIDS), including 


(a) a diagnosis of AIDS, or 


(b) one positive result on an ELISA test. 
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Ontario: 


Ontario Regulation 161/84 adds AIDS to the 
list of communicable diseases under the 
Health Protection and Promotion Act, 1983 °. 
Ontario Regulation 162/84 designates AIDS 
as a reportable disease under the Act. 


Because AIDS is both a reportable and a 
communicable disease, any of several per- 
sons may be involved in reporting AIDS to 
health authorities. 


Section 25 of the Act requires a physician or 
certain persons entitled to practise a health 
discipline who, while providing professional 
services to a person who is not a patient or 
out-patient of a hospital, forms the opinion 
that a person has or may have a reportable 
disease to report this to the medical officer of 
health. 


Section 26 requires a physician providing 
professional services to a person to report any 


communicable disease to the medical officer 


of health. 


School principals must report communicable 
diseases. Laboratory operators must report 
reportable diseases. Hospital administrators 
must report both. 


Section 30 requires a physician who signs a 
medical certificate of death to report to the 
medical officer of health any death from a 
reportable disease. 


Where AIDS is reported under the Health 
Protection and Promotion Act, 1983, the per- 
son reporting must specify at least the follow- 
ing: name and address of affected person, 
date of birth and sex.’ In addition, Ontario 
Regulation 490/85 requires physicians or cer- 
tain other health care professionals to include 
specific information in their report. That in- 


formation includes date of diagnosis, the 
name and address of the physician, the name 
of hospital and date of admission, if ap- 
plicable, medical conditions, including 
laboratory findings and date of diagnoses that 
may be indicative of cellular immune 
deficiency and AIDS, other medical condi- 
tions that may have caused immunosuppres- 
sion, date and place of donation of blood or 
blood products, current status of infected 
person (alive or dead), and whether the per- 
son is a homosexual or bisexual, an in- 
travenous drug abuser or a hemophiliac. 


Prince Edward Island: 


In 1985, the Notifiable and Communicable 
Diseases Regulation © made AIDS a report- 
able disease. Section 17 of the Regulation 
stated that an occurrence of AIDS "must be 
reported to the Chief Health Officer or his 
delegate". 


A 1987 amendment to the Regulation added 
"HIV antibodies" to the list of notifiable dis- 
eases. Section 17 was also amended to re- 
quire that an occurrence "must be reported to 
the Chief Health Officer or his delegate in 
such manner as the Chief Health Officer may 
direct". ‘' It therefore appears that the Chief 
Health Officer may require the infected per- 
son to be identified. 


Quebec: 


The Regulation respecting the application of 
the Public Health Protection Act’ was 
amended on October 1, 1986 to add "acquired 
immune deficiency syndrome" to the list of 
diseases that must be declared. 


Section 30 of the amended regulation re- 
quires that a diagnosis of AIDS be declared 
by the attending physician to the public health 
department within 48 hours. The informa- 
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tion to be indicated on the reporting form 
includes the patient’s name, date of birth, sex 
and locality. The form also provides a place 
for clinical observations and test results. 


Saskatchewan: 


AIDS was made a notifiable communicable 
disease in 1984. In 1988, new regulations 
were to come into force making HIV infec- 
tion a notifiable communicable disease. 


ii) In Other Countries 


Many other countries and jurisdictions within 
those countries have also opted to require 
reporting of AIDS, infection with HIV, or 
both. Information supplied by the World 
Health Organization ' indicates that among 
those countries are Australia, Austria, Ber- 
muda, Brazil, Brunei Darussalam, Chile, 
Costa Rica, Denmark, Egypt, Finland, 
France, Federal Republic of Germany, 
Greece, Hungary, Israel, Italy, Malta, 
Mexico, Monaco, Mozambique, New 
Zealand, Norway, Panama, Paraguay, Peru, 
Poland, Singapore, Spain, Sweden, Switzer- 
land, Thailand, USSR (implicitly), and the 
United States. 


In some countries, a diagnosis of AIDS trig- 
gers the notification requirement. In others, 
a finding of seropositivity or a diagnosis of an 
affliction normally associated with AIDS (Is- 
rael) is enough to bring the reporting require- 
ments into play. 


The precise details of each piece of legisla- 
tion requiring notification are not relevant. 
What is important is the broad similarity of 
responses by many governments. AIDS, 
ARC (symptomatic HIV infection), 
seropositivity or diseases normally associated 
with AIDS appear to be reportable in at least 
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34 countries. Systematic collection of AIDS- 
related personal information and non- 
nominal information is permitted or required 
by legislation throughout the world. Legisla- 
tion about AIDS is evolving so rapidly that 
the number of countries with reporting re- 
quirements probably far exceeds 34. The 
New York Times noted in a 1988 article, for 
example, that nearly 600 AIDS-related laws 
had been proposed across the United States 
alone, and that nearly 90 had been enacted in 
the previous year.’ 


Beyond legislation, countries may have in- 
stituted policies that require or facilitate the 
collection of AIDS-related personal informa- 
tion. 


(c) Federal Legislation 


As yet, there is no federal legislation specifi- 
cally requiring the reporting of AIDS or in- 
fection with HIV. Several government 
institutions nonetheless collect AIDS-related 
personal information, or are contemplating 
collection. Several collection programs are 
discussed briefly in Appendix III. 


When AIDS-related personal information is 
collected, used or disclosed by a federal 
government institution, the Privacy Act 
comes into play. 


Government institutions are also controlled 
by specific legislation, such as the Canadian 
Human Rights Act. The Canadian Charter of 
Rights and Freedoms may impose other con- 
straints on collection, use and disclosure as 
well. 
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(i) The Privacy Act 


Unlike provincial health care legislation, the 
Privacy Act does not require the collection of 
information. Instead, it restricts collection. 
Like many provisions of provincial health 
care legislation, however, it controls what use 
may be made of the information, and the 
extent to which disclosures of the information 
are permitted. 


Section 2 of the Privacy Act describes its pur- 
pose: 


The purpose of this Act is to extend the 
present laws of Canada that protect the 
privacy of individuals with respect to per- 
sonal information about themselves held 
by a government institution and that pro- 
vide individuals with a right of access to 
such information. 


"Personal information" is defined in section 3 
to mean "information about an identifiable 
individual that is recorded in any form includ- 
ing, without restricting the generality of the 
foregoing, ... (b) information relating to the... 
medical ... history of the individual ...". 


It seems clear that the Act covers information 
indicating whether a person is infected with 
the HIV or has developed AIDS or 
symptomatic HIV infection. Given that the 
Act applies to information relating to the 
medical history of the individual, it therefore 
encompasses information indicating whether 
an individual has been tested for the presence 
of the HIV antibody and the test results. It 
encompasses as well whether the person was 
advised to take an HIV antibody test or any 
tests associated with AIDS, whether the per- 
son asked for one or refused one, or whether 
the person received any form of pre-test or 
post-test counselling. In short, the personal 


information protected by the Act includes all 
the information we defined in Part I as 
"AIDS-related personal information". 


Collection of Personal 
Information 


The principal restriction on collecting per- 
sonal information is stated in section 4 of the 
Act: 


No personal information shall be col- 
lected by a government institution unless 
it relates directly to an operating program 
or activity of the institution. 


Subsection 5(1) requires that, wherever pos- 
sible, a government institution collect direct- 
ly from the individual any personal 
information that is intended to be used for an 
administrative purpose. There are two ex- 
ceptions to this general rule: the individual 
may authorize another form of collection or 
the personal information may be disclosed to 
the institution in one of the circumstances set 
out in subsection 8(2). 


Subsection 5(2) requires that the government 
institution inform any individual from whom 
it collects personal information of the pur- 
pose for which the information is collected. 


It is not necessary to fulfil the requirements 
of subsections 5(1) and S(2), however, in two 
Situations set out in subsection 5(3): where 
compliance with subsections 5(1) and (2) 
might result in the collection of inaccurate 
information or where it might defeat the pur- 
pose or prejudice the use for which informa- 
tion is collected. 


The Act imposes the obligation to collect 


accurate, up-to-date and complete informa- 
tion. Subsection 6(2) states: 
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A government institution shall take all 
reasonable steps to ensure that personal 
information that is used for an ad- 
ministrative purpose by the institution is 
as accurate, up-to-date and complete as 
possible. 


Subsection 6(1) states that, once collected, 
personal information that a government in- 
stitution uses for an administrative purpose 
must be retained for a period prescribed by 
regulation. 


Subsection 4(1) of the Privacy Regulations »° 
sets out time limits for retaining information: 


Personal information concerning an in- 
dividual that has been used by a govern- 
ment institution for an administrative 
purpose shall be retained by the institution 


(a) for at least two years following the 
last time the personal information was 
used for an administrative purpose un- 
less the individual consents to its dis- 
posal; and 


(b) where a request for access to the 
information has been received, until 
such time as the individual has had the 
opportunity to exercise all his rights 
under the Act. 


Use of Personal Information 


Section 7 addresses the use of personal infor- 
mation: 


Personal information under the control of 
a government institution shall not, 
without the consent of the individual to 
whom it relates, be used by the institution 
except 


58 - Appendix II 


AIDS and the Privacy Act —=———— ey“ 


(a) for the purpose for which the infor- 
mation was obtained or compiled by the 
institution or for a use consistent with 
that purpose; or 


(b) for a purpose for which the informa- 
tion may be disclosed to an institution 
under subsection 8(2). 


Disclosure of Personal 
Information 


Section 8 deals with disclosure of personal 
information. Subsection 8(1) states: 


Personal information under the control of 
a government institution shall not, 
without the consent of the individual to 
whom it relates, be disclosed by the institu- 
tion except in accordance with this sec- 
tion. 


Subsection 8(2) lists some 13 situations 
where personal information may be disclosed 
without the consent of the individual. 
Among them are the following: where the 
information is used for the purpose for which 
it was obtained by the institution, or for a 
consistent use; for certain types of research, 
and where the public interest in disclosure 
clearly outweighs any invasion of privacy that 
could result. 


Access to Personal Information 


Section 12 of the Privacy Act provides in- 
dividuals a right of access to their own per- 
sonal information. That information may be 
contained in a personal information bank. It 
may also be personal information otherwise 
under the control of agovernment institution. 
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Subsection 12(2) sets out the rights of in- 
dividuals given access to information con- 
tained in a personal information bank. The 
subsection applies only where the informa- 
tion has been used, is being used or is avail- 
able for use for an administrative purpose. 


Subsection 12(2) offers the individual three 
options. The individual may: 


(a) request correction of the personal in- 
formation where the individual believes 
there is an error or omission therein; 


(b) require that a notation be attached to 
the information reflecting any correction 
requested but not made; and 


(c) require that any person or body to 
whom such information has been dis- 
closed fer use for an administrative pur- 
pose within two years prior to the time a 
correction is requested or a notation is 
required under this subsection in respect 
of that information 


(t) be notified of the correction or nota- 
tion, and 


(it) where the disclosure is to a govern- 
ment institution, the institution make 
the correction or notation on any copy 
of the information under its control. 


The right of access and the right to require 
correction, notation or notification are 
generally available only to Canadian citizens 
or permanent residents. Under subsection 
12(3), however, the Governor in Council may 
extend the right of access to other individuals. 
In June 1983 these rights were extended to 
inmates of federal penitentiaries who are not 
Canadian citizens or permanent residents. 15 


The right of access is not, however, unlimited. 
Several sections limit access. These excep- 
tions to the right of access are specific. Some- 
times the head of a government institution 
has the discretion to override the exception. 
Other times, the exception cannot be waived: 
it is mandatory. We mention here three 
relevant exceptions to the right of access. 


Section 19 deals with personal information 
obtained by a government institution in con- 
fidence from certain other bodies. Where, 
for example, a province provides personal 
information to a government institution in 
confidence, the information cannot be dis- 
closed where the affected individual seeks 
access under subsection 12(1). Only if the 
province consents to the disclosure or makes 
the information public can the government 
institution permit access under subsection 
12(4): 


Section 25 permits a head of a government 
institution to refuse to disclose any personal 
information requested under subsection 
12(1) where the disclosure could reasonably 
be expected to threaten the safety of in- 
dividuals. 


Section 28 permits the head of an institution 
to refuse to disclose any personal information 
requested under subsection 12(1) that relates 
to the physical or mental health of the in- 
dividual who requested it where the examina- 
tion of the information by the individual 
would be contrary to the individual’s best 
interests. 


(ii) Other Federal Legislation 


Several other federal acts provide for the 
handling of personal information, some of 
which could be AIDS-related. Following are 
examples of such provisions. 
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Section 8 of the Canadian Human Rights 
Act'® labels as discriminatory practices the 
use of certain employment forms that express 
or imply any limitation, specification or 
preference based on a prohibited ground of 
discrimination. Making written or oral in- 
quiries to the same effect is also considered a 
discriminatory practice. Among prohibited 
grounds of discrimination is that based on 
disability. The definition of disability means 
any existing or previous mental or physical 
disability. Accordingly, the collection of 
AIDS-related personal information by an 
employer or prospective employer may vio- 
late the Act unless exceptions set out in the 
Act are met. 


The Act provides for the investigation of 
complaints, the making of orders to cease 
discriminatory practices and the imposition 
of criminal penalties for various breaches of 
its provisions. 


Subsection 104(1) of the Canada Pension 
Plan *’ establishes a general rule protecting 
the confidentiality of information about any 
individual contributor or beneficiary. Ac- 
companying subsections set out several ex- 
ceptions to the general rule. Subsection 
104(8) creates an offence punishable on sum- 
mary conviction where an officer, clerk or 
employee of the Crown contravenes the sec- 
tion. 


Section 96 of the Unemployment Insurance 
Act ® states as follows: 


Information, written or oral, obtained by 
the Commission or the Department of 
Employment and Immigration from any 
person under this Act or any regulation 
thereunder shall be made available only 
to the employees of the Commission or the 
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Department in the course of their employ- 
ment and such other persons as the Min- 
ister deems advisable.... 


Section 96 also places controls on the use of 
information as evidence in any proceedings 
not directly concerned with the enforcement 
or interpretation of the Act. 


Section 241 of The Income Tax Act "’ places 
restrictions on use and disclosure of tax infor- 
mation. The general rule prohibits com- 
munication of information and access by any 
person to certain tax information. 


The section places restrictions on use of the 
information in legal proceedings. It also 
specifies when an official or authorized per- 
son may communicate information. These 
instances include communications such as 
those made for the purposes of the Act, com- 
munications to provincial governments, com- 
munications to the taxpayer involved, and 
communications to evaluate or enforce the 
Unemployment Insurance Act, 1971. 


Subsection 241(9) creates a summary convic- 
tion offence if an official or authorized person 
contravenes the confidentiality provisions. 


The Statistics Act * authorizes the collection 
of information and statistics. These are then 
used to analyze the characteristics and be- 
haviour of Canadian households, businesses, 
institutions and government for research, 
policy development, program administration, 
decision-making and general information. 
The Act also sets limits on using and disclos- 
ing the information collected. Subsection 
17(1) contains a broad prohibition against 
allowing unauthorized persons to examine an 
identifiable individual return. It also 
prohibits disclosure by authorized persons of 
information that would make it possible to 
relate particulars of the information to any 
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identifiable individual person, business or or- 
ganization. Every person who contravenes 
subsection 17(1) is guilty of an offence under 
section 30. He or she may be imprisoned for 
up to six months, fined, or both. 


Subsection 17(2) gives the Chief Statistician 
the discretion to disclose certain types of con- 
fidential information. These disclosures are 
regulated by internal policy and do not in- 
clude disclosure of personal information un- 
less consent is obtained from the individual 
to whom the information relates. 


Subsection 18(1) states that information ob- 
tained by Statistics Canada is privileged, ex- 
cept for a prosecution under the Statistics Act. 


(iii) Penalties for Improper 
Collection, Use and Disclosure 


The Privacy Act provides no statutory remedy 
for breaches of its provisions. As can be seen 
above, however, several provisions of legisla- 
tion dealing with specific government ac- 
tivities do. In addition, a person who in bad 
faith made public AIDS-related personal in- 
formation might face a civil lawsuit; section 
74 of the Act would not protect an employee 
of government in such circumstances. He or 
she might also face criminal prosecution for 
breach of trust under section 122 of the 
Criminal Code.’ Criminal charges, for ex- 
ample, were used in one recent case *” involy- 
ing the unauthorized use of taxation records. 


Section 122 of the Code reads: 


Every official who, in connection with the 
duties of his office, commits fraud or a 
breach of trust is guilty of an indictable 
offence and is liable to imprisonment for 
aterm not exceeding five years, whether or 


not the fraud or breach of trust would be 
an offence if it were committed in relation 
to a private person. 


In addition, the Government Security 
Policy” issued by the Secretary of the 
Treasury Board sets out policy measures to 
safeguard sensitive information maintained 
by government. Section .3.1 states: 


Personal information, as defined in 
Section 3 of the Privacy Act, is a special 
case and shall be given enhanced 
protection ... where its unauthorized 
disclosure would, in the opinion of the 
deputy head, be certain to cause an un- 
warranted invasion of privacy. Ex- 
amples include sensitive medical files .... 
(their emphasis) 


The policy requires government institutions 
to protect sensitive information 


e by limiting access to those persons who 
have a "need to know" in relation to the 
performance of their duties or tasks, and 
who have met the requirements of an 
enhanced reliability check; and 


e by applying government-wide standards 
approved by Treasury Board covering 
physical, EDP, communications- 
electronic and technical intrusion 
security.” 


Breaches of security relating to sensitive in- 
formation (the unauthorized disclosure of or 
access to) are handled as follows: 


Possible breaches of security shall be 
reported immediately to the deputy 
head. Institutions shall then assess the 
circumstances to determine whether it 
is probable that a breach has occurred. 
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Suspected breaches constituting 
criminal offences shall be reported to 
the appropriate law enforcement 
authority. (their emphasis)” 


Injury assessments and investigations may 
follow a breach of security. A violation of 
security may include any of the following: 


e failure to protect sensitive information 


e modifying, retaining, destroying or 
removing sensitive information without 
authorization, or 


e causing unauthorized interruption to 
the flow of sensitive information. 7° 


Sanctions are to be applied after breaches or 
violations of security where the deputy head 
concludes that there has been misconduct or 
negligence. The sanctions may be ad- 
ministrative, disciplinary or statutory. 
Deputy heads may apply any of the following 
disciplinary or administrative sanctions: 


e termination of classification authority 


e removal of security clearance and access 
to classified information 


e removal of enhanced reliability status 
and loss of access to sensitive informa- 
tion, and 


e disciplinary sanctions (oral reprimand, 
written reprimand, suspension with or 
without pay, discharge). 7” 


Finally, the Canadian Charter of Rights and 
Freedoms may be used to challenge actions by 
government institutions. Whatever actions 
government institutions take, they must en- 
sure compliance with the Charter. 
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From the privacy perspective, two Charter 
sections are germane. Section 7 states: 


Everyone has the right to life, liberty and 
security of the person and the right not to 
be deprived thereof except in accordance 
with the principles of fundamental justice. 


Section 8 states: 


Everyone has the right to be secure against 
unreasonable search or seizure. 


The 1988 Supreme Court of Canada decision, 
R. v. Dyment,” underlined the potential 
power of section 8 to protect individual 
privacy. In concurring reasons for judgment, 
Mr. Justice La Forest stressed: 


And that right [contained in section 8], 
like other Charter rights, must be inter- 
preted in a broad and liberal manner so 
as to secure the citizen’s right to a 
reasonable expectation of privacy 
against governmental encroachments.”’ 


Mr. Justice La Forest spoke specifically about 
privacy in relation to information: 


As the Task Force [on Privacy and Com- 
puters] put it ... "This notion of privacy 
derives from the assumption that all in- 
formation about a person is in a fun- 
damental way his own, for him to 
communicate or retain for himself as he 
sees fit." In modern society, retention of 
information about oneself is extremely 
important. We may, for one reason or 
another, wish or be compelled to reveal 
such information, but situations abound 
where the reasonable expectations of 
the individual that the information shall 
remain confidential to the persons to 
whom, and restricted to the purposes for 
which it is divulged, must be protected.” 


Later, Mr. Justice La Forest referred to the 
facts of the Dyment case, which involved the 
taking of a blood sample without consent to 
allow the blood to be tested for evidence of 
impairment. "[T]he use of a person’s body 
without his consent to obtain information 
about him, invades an area of personal 
privacy essential to the maintenance of his 


human dignity".! 


Any form of coercion to consent to an HIV 
antibody test, or the testing of blood without 
consent, might well be challenged as being an 
unreasonable search or seizure under section 
8. The collection of AIDS-related personal 
information may be seen in a similar light. 
The outcome of challenges on these grounds 
cannot be predicted. Among the factors 
courts will have to consider are the size of the 
threat from AIDS, the accuracy of the tests, 
beneficial or detrimental consequences of 
administering the test and the usefulness of 
personal information. The relative weights 
of these factors may change over time. 


Even if the courts find the search or seizure 
to be unreasonable, they may nonetheless 
allow the absolute prohibition of section 8 to 
be softened by section 1. Section 1 guaran- 
tees the rights and freedoms set out in the 
Charter "subject only to such reasonable 
limits prescribed by law as can be 
demonstrably justified in a free and 
democratic society”. 


Section 7 is similarly difficult to analyze. Will 
the collection, use or disclosure of informa- 
tion about a person’s HIV status be construed 
as a deprivation of liberty or security? Courts 
will be obliged to review matters such as the 
size of the threat posed by AIDS, the accuracy 
of the information being stored and the 
beneficial or detrimental consequences of 
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storing the information. And, as above, the 
courts may allow section 1 to soften the strict 
prohibitions of section 7. 


This report makes no attempt to analyze in 
detail the implications of the Charter for 
AIDS. There are many instances besides 
those listed above where the Charter will be 
brought into service to tackle AIDS issues. 
The report merely reminds the reader that 
government collection, use and disclosure of 
AIDS-related personal information may one 
day be assessed against the Charter, and that 
the Charter may provide remedies besides 
those discussed above. If a court finds a 
breach, subsection 24(1) of the Charter per- 
mits it to provide "such remedy as the court 
considers appropriate and just in the cir- 
cumstances". 
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Appendix III 


DEPARTMENTAL POLICIES ON HIV INFECTION AND AIDS 


Treasury Board 


From a safety and health perspective, 
Treasury Board is responsible only for 
federal public service employees. The 
remainder of public employees are dealt with 
under the Canada Labour Code. 


There will be no testing for the public service 
in the foreseeable future. Treasury Board is 
preparing a written policy on AIDS. Infor- 
mation kits will be made available to 
employees. Employees can be tested in the 
private sector (as can anyone else). 


There are 17 standard employee information 
banks. All employee medical records are 
held by Health and Welfare Canada only. 


The public service has access to an Employee 
Assistance Program to provide counselling 
for various problems -- for example, al- 
coholism. Employees are referred to private 
sector agencies. Information is held strictly 
in confidence by the counsellor; the 
employee’s department is not allowed access 
to this information. 


Legal counsel at Treasury Board identified 
the following information banks as being 
most likely to contain information arising 
from a diagnosis of AIDS or seropositive 
status. There was no indication, however, 
that these information banks actually do con- 
tain this information. 


e TBS/P-CE-705 - Personnel Manage- 
ment Information System 


e TBS/P-CE-706 - Special Groups Iden- 
tification Survey 


¢ TBS/P-CE-718 - Leave Reporting Sys- 
tem 


e TBS/P-CE-803 - Complaints - Canadian 
Human Rights Commission 


e TBS/P-CE-804 - Personal Harassment 
Complaints . 


In addition, Treasury Board identified the 
following standard banks (each department 
has its own set of files, but the description of 
the bank is the same throughout govern- 
ment): 


e TBS/P-SE-901 - Employee Personnel 
Record 


e TBS/P-SE-903 - Attendance and Leave 


e TBS/P-SE-919 - Personal Harassment. 


Department of Justice 


The department treats AIDS-related per- 
sonal information as any other medical infor- 
mation about an identifiable individual. The 
department believes that information about 
AIDS should not be treated any differently 
than other medical information. For ex- 
ample, a person should have the right to ex- 
amine the information and to correct it. 
There is therefore much protection to be of- 
fered by the Privacy Act to AIDS-related per- 
sonal information as a species of "medical 
information". The department recognizes 
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the various controls that are placed on the 
collection of this information -- for example, 
direct collection. 


The department is sensitive to the require- 
ment of section 4 of the Act permitting col- 
lection of personal information only where it 
relates directly to an operating program or 
activity of the institution. The department 
believes that such information may properly 
be collected under section 4 for the following 
purposes: the Employee Assistance Program, 
Canada Pension Plan, Unemployment In- 
surance and for statistical purposes under the 
Statistics Act. 


Individuals should be told why information is 
being collected from them. Privacy Act con- 
trols on retention should also apply. 


The greatest Privacy Act concern is disclosure 
in the public interest. The department invites 
other departments to be sensitive to issues of 
disclosure under section 8. 


The department recognizes that the Privacy 
Act merely affords one form of protection. 
Other legislation directed at specific govern- 
ment institutions may offer even greater 
protection than the Privacy Act. 


Where there is a wilful spread of HIV infec- 
tion, the department feels the best action is 
to provide information to public health 
authorities who can then rely on the police to 
act. 


Correctional Service Canada 
Correctional Service Canada has identified 
three personal information banks that may 


identify persons who have AIDS or who test 
antibody-positive: 
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CSC/P-PU-060 - Offender Health Care 
Record (Bank description: This bank 
permits the storage and retrieval of 
records on an offender’s health care 
within the federal institution and the 
community) 


CSC/P-PU-061 - Psychiatric Treatment 
Centres (Bank description: This bank 
contains psychiatric records and some 
medical information pertaining to of- 
fenders treated in Psychiatric Treat- 
ment Centres) 


CSC/P-PU-070 - Psychology (Bank 
description: This bank permits the 
storage and retrieval of psychological 
records and data). 


The first bank - Offender Health Care 
Record - is the most likely repository of 
AIDS-related personal information. 


On January 1, 1988, Commissioner’s Direc- 
tive 821 was issued. The directive is entitled 
"Management of Inmates with Human Im- 
munodeficiency Virus (HIV) Infections". 
The directive deals with several issues. 
Among them are penitentiary placement, 
testing, preventive measures, education and 
confidentiality. 


(i) Inmate Testing 


Section 9 of the directive states that upon 
entry into the correctional system or during 
incarceration, inmates shall not be routinely 
screened for presence of antibodies to HIV. 


Section 10 states that testing shall be 
governed by criteria for valid consent set out 
in Commissioner’s Directive 803. The latter 
directive sets out several criteria for a valid 
consent. Section 2 reads as follows: 


——— ais and te very tk 


In order for consent to be valid, it shall 
pe: 


(a) freely given; 


(b) informed, that is, based on sufficient 
information provided to the individual 
by a qualified professional; 


(c) specific to the treatment or proce- 
dure; 


(d) given by a competent individual or 
by someone competent on his/her be- 
half, that is, having the mental ability to 
understand the nature and risks of ac- 
cepting or refusing the treatment [test- 


ing]; 


(e) based on or in compliance with 
provincial legislation, such as age of 
majority; and 


(f) normally written and witnessed al- 
though, in some circumstances, consent 
may be given verbally or it may be im- 
plied. 


Section 3 states that consent is required for 
any medical examination, procedure or treat- 
ment. Section 4 states that during his incar- 
ceration, the offender may refuse consent 
when he does not put his life in danger, even 
if the security of the institution or of other 
persons may be threatened. 


Several exceptions to the consent require- 
ment are permitted by Commissioner’s 
Directive 803. None of them, however, ap- 
pear to apply to HIV antibody testing. Ac- 
cordingly, it appears that Commissioner’s 
Directive 803 gives the inmate an absolute 
right to refuse testing. 


Commissioner’s Directive 821 permits in- 
mates to request testing. Section 11 requires 
inmates wishing to be tested to make the 
request to the institutional physician. The 
institutional physician shall determine if test- 
ing is indicated, based on the need to confirm 
physical examination or laboratory studies 
Suggestive of HIV infection. Requests for 
testing from inmates with a history of high 
risk activities associated with HIV infection 
shall be carried out at the discretion of the 
institutional physician. 


Section 11 appears, therefore, to require ap- 
proval of the institutional physician if an in- 
mate wishes to be tested. 


(ii) Confidentiality and 
Disclosure of AIDS-related 
Personal Information about 
Inmates 


Section 19 of Commissioner’s Directive 821 
requires that all diagnoses of HIV infection 
be noted on the problem sheet of the medical 
record. Once informed, health care staff 
must comply with the confidentiality and dis- 
closure provisions of Commissioner’s Direc- 
tive 835. 


Section 12 of that Directive reads as follows: 


Offenders have the same rights to con- 
fidentiality of information obtained by a 
health care professional as exists in the 
general community. However, it is the 
responsibility of a health care profes- 
sional, when there is reasonable cause to 
believe that the offender’s intentions or 
possible actions may constitute a threat 
to the safety of him/herself or others, to 
provide information to the appropriate 
personnel without the offender’s con- 
sent (our emphasis). 
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Section 11 states that a medical administra- 
tive summary outlining significant findings of 
interest to those involved in the case manage- 
ment of an offender shall be provided for 
placement on the offender record. (The ad- 
ministrative summary, is not intended, we are 
told, to relay diagnostic or medical confiden- 
tial information. Details of an inmate’s medi- 
cal condition or HIV status should not be 
disclosed in this document.) 


Accordingly, information about an inmate’s 
HIV status can be held in the institutional 
health care record. This record moves with 
the offender throughout his or her sentence. 


Section 13 of the directive states that health 
care records are to be retained until ten years 
after the most recent warrant expiry date or 
according to the provincial legislation where 
the offender was last treated medically, 
whichever is the longer period of time. 


Commissioner’s Directive 821 contains fur- 
ther instructions on disclosure of information 
about HIV status. Section 21 states as fol- 
lows: 


The HIV status of an inmate is medical 
confidential. This information shall not 
be released to supervisory/agency staff 
without the inmate’s consent. However, 
if there is cause to believe that an 
offender’s actions may constitute a 
danger to himself or others, and in ac- 
cordance with the Privacy Act, health 
care staff shall provide information to 
the appropriate personnel without the 
offender’s consent. 


Generally, however, staff members are con- 


sidered not to have a need to know about the 
HIV infection status of an inmate. 
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Section 23 of Commissioner’s Directive 821 
deals with notification of public health 
authorities: 


HIV infection reporting shall be in ac- 
cordance with relevant provincial public 
health legislation and practice. 
Regional Headquarters, through 
Regional Instructions, shall ensure that 
institutions are aware of the provincial 
legislation. 


The Commissioner’s Directives to which we 
have referred do not directly address dis- 
closure of HIV infection to other inmates. It 
may be implied, however, that because this 
information is considered personal medical 
information, it will not be disclosed to other 
inmates. 


Commissioner’s Directive 821 envisages 
isolating those who do not cooperate by 
reducing high-risk behaviour: 


17. The Director may decide to isolate 
an inmate who fails to cooperate and 
continues to engage in activities that 
place others at risk for infection with 
HIV. 


Employment and Immigration 
Canada (EIC) 


(i) Unemployment Insurance 
Applicants 


There appear to be no special policies of the 
Unemployment Insurance Commission 
relating to collection of AIDS-related per- 
sonal information. 


<<< —————————— AIDS and the Privacy Act 


A claimant for Unemployment Insurance 
benefits because of illness must prove entit- 
lement. To this end, a medical certificate 
indicating diagnosis is required. Sickness 
benefits are available for some six to seven 
hundred conditions. The benefit period 
varies with the period of incapacity and with 
the success of treatment. A numeric code is 
assigned to a particular condition. 


Employment and Immigration Canada (EIC) 
States that it is essential that an exact diag- 
nosis be supplied. It would not be practical 
to single out AIDS sufferers by not recording 
the identity of their illness. Treating them 
differently, EIC argues, would clearly identify 
them and could lead to accusations of dis- 
crimination. 


Counsel from Legal Services at Employment 
and Immigration identified the following Un- 
employment Insurance banks which may con- 
tain AIDS-related personal information: 


e EIC/P-PU-005 - Registration for 


Employment File 


e EIC/P-PU-150 - Unemployment In- 
surance Claim File 


e EIC/P-PU-155 - Unemployment In- 
surance Claimant’s Bi- Weekly Report 
Card 


e EIC/P-PU-170 - Interstate Unemploy- 
ment Insurance Claims 


e EIC/P-PU-180 - Benefit and Overpay- 
ment Master File. 


Counsel indicated that claims have been 
received under the Unemployment Insurance 
Act, 1971 from claimants suffering from 
AIDS. There are no statistics available on the 


precise number of such claims. Officials at 
EIC estimate the number to be between 10 
and SO. 


Section 96 of the current Unemployment In- 
surance Act restricts the release of informa- 
tion: 


Information, written or oral, obtained by 
the Commission or the Department of 
Employment and Immigration from any 
person under this Act or any regulation 
thereunder shall be made available only 
to the employees of the Commission or the 
Department in the course of their employ- 
ment and such other persons as the Min- 
ister deems advisable, and neither the 
Commission, nor the Department nor any 
of the employees of the Commission or 
Department is compellable to answer any 
question concerning that information, or 
to produce any records or other docu- 
ments containing that information as 
evidence in any proceedings not directly 
concerned with the enforcement or inter- 
pretation of this Act or the regulations. 


In addition, the Employment and Immigra- 
tion Insurance Services Policy Manual (Sub- 
ject 20) deals with the privacy of information 
contained in a claimant’s file. It outlines to 
whom and when information contained in a 
claimant’s file may be disclosed. - 


Section 4 of the manual (Subject 20) states: 


[I]nformation regarding diagnosis of 
sickness, disability, quarantine or mater- 
nity, cannot be divulged to any party, 
except where it is part of an exhibit to a 
Board of Referees or the Umpire. In 
addition, medical information issued by 
the treating physician may be disclosed 
to the claimant or his lawyer if the infor- 
mation is already known to the claimant 
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and is non-controversial ... or if it was 
provided by the claimant in the first 
place.... Both medical information and 
other types of controversial information 
must be released as part of the Ul appeal 
process. 


Section 4 therefore appears to exclude any 
disclosure of medical information except in 
narrowly defined circumstances. 


Elsewhere, the manual spells out when infor- 
mation about a claimant can be disclosed. It 
is not clear from the manual whether this 
discussion of disclosure relates as well to in- 
formation about the medical condition of the 
claimant. We assume that it does not, due to 
the restrictive wording of section 4. None- 
theless, we reproduce the substance of the 
manual as it deals with permissible dis- 
closure. 


Section 6 of the manual states: 


Information contained in the claimant’s 
file may be disclosed to the following 
persons and organizations to the extent 
indicated.... [the claimant, the claimant’s 
representative, Revenue Canada, Taxa- 
tion, welfare agencies, Canada or 
Quebec Pension Plan representatives, 
other government departments or agen- 
cies, employers]. 


Under section 6, several qualifications are 
placed on the dissemination of information 
about claimants. Qualifications that appear 
to affect the release of medical information 
are set out below: 


(1) Revenue Canada, Taxation: The ad- 
ministration of the Act is divided be- 
tween Revenue Canada, Taxation and 
the Unemployment Insurance Commis- 
sion. Information in a claim file re- 
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quired for the administration of Section 
3 and Part IV of the Act is to be made 
available to Revenue Canada on re- 
quest. 


(2) Welfare Agencies: Information in a 
claimant’s file relating to the reason for 
separation from employment, among 
other matters, may be given to 
municipal, provincial or federal welfare 
agencies. Section 6.4 states that the in- 
formation should be restricted to that 
required to enable the welfare agencies 
to determine the claimant’s eligibility 
for welfare benefits. 


(3) Employers: In normal fact-finding 
for adequate adjudication, the 
claimant’s reason for separation may be 
divulged to his former employer, within 
the limitation of this guideline. 


When an employer wishes to appeal a 
decision to a Board of Referees or the 
Umpire, information that has led to the 
decision being appealed may be 
released to that employer. This may in- 
clude controversial information relating 
to labour disputes or reason for separa- 
tion from employment given by the 
claimant. 


(4) Criminal Cases: Section 7 provides 
that an employee who is subpoenaed to 
a criminal court will disclose any infor- 
mation necessary for the conduct of the 
hearing. In any other case: the 
employee will inform the court that sec- 
tion 114 of the Unemployment Insur- 
ance Act, 1971 [now section 96 of the 
Unemployment Insurance Act] does not 
permit the release of information con- 
tained in the claimant’s file. 


T= AIDS and the Privacy Act 


(ii) Immigrants 


Section 11 of the Immigration Act requires 
the medical examination of all immigrants. 
Paragraph 19(1)(a) sets out criteria for inad- 
missibility. Regulations specify which 
visitors must be tested. Also, individuals who 
are eligible to apply for employment 
authorization may be required to undergo 
medical tests. Regulations specify what fac- 
tors a medical officer will consider. None of 
these provisions deal specifically with AIDS. 


The present legislative and policy position of 
EIC can be summarized as follows: 


e immigrants or long term visitors with 
AIDS or HIV seropositivity are not ad- 
missible to Canada 


e no mandatory testing of immigrants or 
visitors for HIV infection takes place 
(although some Health and Welfare 


Canada physicians posted abroad have. 


apparently decided nonetheless to con- 
duct HIV antibody tests) 


e EIC favours the compulsory HIV an- 
tibody testing of both immigrants and 
long-term visitors. 


Some provisions of the Immigration Act can 
lead to disclosure of medical conditions. The 
sponsors of a potential immigrant have aright 
to know the grounds for rejecting an applica- 
tion. This right is based on subsection 77(1) 
of the Immigration Act, subsection 4(1) of the 
Immigration Regulations and on jurispru- 
dence (Palta v. Minister of Employment and 
Immigration (Federal Court of Appeal, File 
No. A937-82)). 


The criteria for admissibility of immigrants 
are determined by Health and Welfare 
Canada in consultation with EIC. Respon- 
sibility for enforcing the Immigration Act lies 
with EIC. Any person with a communicable 
disease is a member of an inadmissible class 
under subsection 19(1) of the Immigration 
Act. 


All prospective immigrants require medical 
tests, including blood tests. The embassy 
refers applicants for landed immigrant status 
to a list of local physicians. Physicians are 
given a list of necessary procedures. They 
sometimes test for HIV antibodies (embas- 
sies do not require HIV tests, but there is no 
way of controlling "surplus" information 
given by a local physician). The physician 
normally passes medical information directly 
to Health and Welfare Canada. Where there 
are difficulties with the local mail system, 
however, reports will be passed on to Health 
and Welfare Canada through the embassy. 


In general, EIC holds no data banks that iden- 
tify individuals with AIDS or HIV infection. 
Only Health and Welfare Canada’s decision 
about medical inadmissibility is passed on to 
EIC, not the reasons for the decision. Some 
individual files might contain AIDS-related 
personal information, but most would not. 


In theory, AIDS-related personal informa- 
tion might be contained in the following files: 


e EIC/P-PU-225 - Immigrant Case File 


e EIC/P-PU-240 - Sponsors of Im- 
migrants 


e EIC/P-PU-245 - Guarantors of Assisted 
Relatives 


e EIC/P-PU-280 - Adjudication Case File 
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e EIC/P-PU-285 - Visitor Case File 


e EIC/P-PU-290 - Foreign Student 
Records and Case File 


e EIC/P-PU-295 - Temporary Worker 
Records and Case Files 


e EIC/P-PU-300 - Minister’s Permit Case 
File. 


(iii) Employees 


Health and Welfare Canada states that an 
employee has a medical disability, but does 
not identify the disability. Therefore, a medi- 
cal certificate does not disclose the nature of 
the disability. Personnel files might disclose 
that an employee has AIDS or HIV infection, 
but this would likely only happen ifthe person 
volunteered the information. 


RCMP 


The RCMP arranges for physical examina- 
tions of applicants. In addition, members 
have regular medical examinations. 


The RCMP does not attempt to collect 
AIDS-related personal information. The 
Force is not even considering such a policy. 


Nonetheless, there may be AIDS-related in- 
formation in two personal information banks: 


e CMP/P-PU-005 - Operational Case 
Records. This bank contains informa- 
tion about individual operations inves- 
tigations and may incidentally include 
information about a person’s HIV- 
Status. 
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e CMP/P-PU-055 - Protection of Person- 
nel and Government Property. These 
records relate to civilian and police 
members. Access to the bank is 
described by the RCMP as being very 
restricted. The information in the bank 
would have to be disclosed through the 
medical officer, who might not disclose 
details of a person’s state of health. In- 
stead, the medical officer might simply 
state whether the person is fit to assume 
certain duties. 


The RCMP has prepared an operational bul- 
letin dealing with encounters with persons 
who are infected. Bulletin AM-1196, on Oc- 
cupational Biological Hazards, centres on 
concerns about AIDS. The bulletin notes 
that there are "very few" cases of occupational 
contact. It also states that there are no docu- 
mented cases of police officers, paramedics 
or firefighters contracting AIDS while per- 
forming their duties. 


The bulletin summarizes the means of trans- 
mission of the HIV. It also describes preven- 
tive actions that officers can take. The 
bulletin does not, however, address issues 
relating to confidentiality. 


Department of National Defence 


In April 1988 the Department of National 
Defence provided to us a substantial briefing 
note on its handling of AIDS- related infor- 
mation. We have also received further cor- 
respondence on this topic. The following 
paragraphs reproduce or summarize some of 
the contents of that note and subsequent cor- 
respondence. 


<= AIDS and the Privacy Act 


The Canadian Forces (CF) possess and col- 
lect information about persons who are in- 
fected with the HIV and those who have 
AIDS. 


(i) Testing 


At present, the CF has no compulsory HIV 
antibody testing program, whether for 
recruits, serving members or others for whom 
the CF provides medical care (in certain loca- 
tions, dependants). 


CF voluntary antibody testing is performed 
primarily in two circumstances: where indi- 
cated clinically (a present illness suggesting 
HIV infection) or where indicated 
epidemiologically (contact tracing, needle- 
stick injury, or a health care worker or patient 
in a high risk group who requires testing). 


Occasionally, testing could be done for a low 
risk patient who, despite counselling, is ex- 
tremely anxious about infection. 


Recently, DND has agreed to test personnel 
selected for Security Assistance Training 
Program training in the United States. Only 
personnel who test antibody negative will be 
sent on such training. This testing prereq- 
uisite was imposed on the Department of 
National Defence by the U.S. Department of 
Defense. The CF considers it necessary to 
comply to satisfy Canadian defence training 
requirements. 


This testing program began in May 1988. It 
involves about 1000 CF members and 200 
Department of National Defence employees 
annually. A training candidate could refuse 
to be tested and would not suffer any direct 
consequences in the CF -- apart, that is, from 
not being able to obtain the U.S. training. 
The CF has not ruled out the possibility of 


ordering individuals to take the test in rare 
circumstances. Department of National 
Defence correspondence to the Office of the 
Privacy Commissioner, dated January 19, 
1989, states as follows: 


In circumstances where the Canadian 
Forces have a limited number of in- 
dividuals who may be able to undertake 
the training and the training is required 
in order to perform the duties of certain 
positions in the Canadian Forces, it may 
not always be possible to operate on a 
voluntary basis. If an insufficient num- 
ber of individuals agree to take the test, 
it may be necessary to order individuals 
to take the test so that the mission of the 
Canadian Forces can be carried out. 
Presumably, this will be a very rare oc- 
currence but it clearly would be justified. 


The correspondence indicated that the CF 
AIDS situation will be studied further. For 
now, all CF HIV antibody testing, including 
that for the U.S. training, involves pre-test 
counselling, informed consent and ap- 
propriate post-test counselling. 


The CF has no capacity to conduct the tests 
itself. All testing is done through provincial 
or federal laboratories. 


At the patient-physician level, test results are 
linked to an individual. The laboratory req- 
uisition sent to the provincial or federal 
laboratory may identify the individual. The 
Surgeon General (of the CF) has recom- 
mended in "Medical Directive 1/88: HIV In- 
fection" that, where the receiving laboratory 
permits, specimens or requisitions be coded 
to protect the identity of the patient outside 
the CF medical unit. The testing program for 
the U.S. DoD training requires that the 
specimens be coded. 
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Those tested are told personally of their test 
results by their physician. 


Information about a person’s HIV status is 
stored in DND/P- PE-819- Medical Records. 


(ii) Positive Test Results 


CF members infected with the HIV are hand- 
led like those with other medical diagnoses. 
They are assigned a "medical category" based 
on how their disease may be affected by the 
requirements of military service and how 
their disease may affect the operation of the 
Ole, 


Categories below a certain level, varying by 
specific trade/classification, result in 
deliberation of the Career Medical Review 
Board (CMRB). The CMRB may decide to 
retain the member on an unrestricted career, 
retain on a restricted career, release or 
remuster the member. Each case is dealt 
with individually. Until the CMRB decides, 
individuals who are well enough to work are 
allowed to do so, but "within certain germane 
limitations based on their clinical status". 
There is no blanket release policy based sole- 
ly on HIV infection. 


(iii) Policies on the Use and 
Disclosure of AIDS- related 
Personal Information 


In February 1986 a Canadian Forces general 
message was issued about the use and dis- 
closure of information on infection and the 
further disposition of infected CF members. 
The message states in part: 


[M]edical information, including 
reports and records relating to the con- 
dition of HTLV-III [former name for 
HIV] infected members, including those 
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who are antibody positive only, will not 
be released to non-medical personnel 
other than to Senior Military authorities 
(including Commanding Officers) with 
a need to know. Further, a member will 
not be released solely on the basis of 
HTLV-II infection unless there are 
demonstrable medical restrictions 
placed on the member which would re- 
quire CMRB consideration. 


A similar message is contained in "Medical 
Directive 1/88: HIV Infection": 


Medical information, including reports 
and records, relating to the condition of 
HIV infected members, including those 
who are asymptomatic, will not be 
released to non-medical personnel 
other than to senior military authorities 
(including CO’s) with a "need to 
know"... 


Non-CF personnel who receive their medical 
care from the CF (e.g., dependants in certain 
locales) and who are found to be infected with 
the HIV would have such information 
recorded in the relevant local individual 
medical documents. They would also be 
reported to civilian public health authorities 
according to provincial law. This information 
would not, however, be recorded in the CF 
hospitalization database. There is currently 
no requirement to report these persons to 
military public health authorities. 


Apart from the Commanding Officer, CF 
members are not informed of the HIV status 
of another member. Members and others for 
whom the CF provides medical care who are 
known to be infected are reported to civilian 
public health authorities in accordance with 
provincial laws. 


————S—— See AIDS and the Privacy Act 


(iv) Civilian Employees 


The Department of National Defence has no 
policy on the collection, use and disclosure of 
information relating to civilian employees 
who may be infected. It does not conduct 
testing or maintain medical records on its 
civilian employees, except to allow them to 
take part in training in the U.S.. As is the 
current policy for CF members, civilian DND 
employees may refuse to take the test. The 
department has indicated that it would wel- 
come a Treasury Board policy for its civilian 
employees. 


Statistics Canada 


(1) General Public 


Two databanks contain AIDS-related per- 
sonal information: 


(1) Mortality database (part of In- 


tegrated Vital Statistics Database) © 


(STC/P-PU-035): This information is 
provided by provincial registrars. One 
element of the database is "cause of 
death". Statistics Canada receives 
copies of death certificates, which in- 
clude name, address, cause of death, 
CUC., 


Uses: To produce information and es- 
timates on death, as well as inter-censal 
population estimates. This information 
is also used for record linkage, for ex- 
ample, for epidemiological studies. Ifa 
mining company provides a list of 
names, Statistics Canada may link this 
with the Mortality database to enable 
the company to assess worker health 
care programs. Such studies in general 
aim at better detecting and estimating 
possible risks to individuals exposed to 


potentially harmful agents and to the 
impact of occupational, environmental 
and social influences on health. 


Statistics Canada will carry out linkages 
for statistical/research purposes only if 
the benefits clearly outweigh the in- 
vasion of privacy. Requests for record 
linkages are screened and submitted to 
a multi-level review process. Even then, 
ministerial approval is required. Infor- 
mation resulting from these linkages is 
not used for making administrative 
decisions affecting an individual. 


(2) Hospital Morbidity (STC/P-PU- 
055): Deals with patients who have been 
discharged from or who die in hospital. 
The information includes the diagnosis. 
Statistics Canada receives morbidity in- 
formation and a patient number to 
which the agency does not have a key. 
Statistics Canada requires an identifica- 
tion number for follow-up -- for ex- 
ample, to clarify personal information 
supplied by a hospital. 


A third databank, Notifiable Diseases, con- 
tains aggregate data only. It contains no per- 
sonal information. 


In general, information relating to AIDS or 
HIV infection would be treated like any other 
information collected under the Statistics Act. 
The Statistics Act (section 17) contains stric- 
ter provisions on confidentiality than those in 
the Privacy Act. Information that identifies 
an individual can only be released as specified 
in section 17 (for example, if the individual 
consents) or, under the Privacy Act, if the 
information is released to the legal repre- 
sentative of a minor or the representative of 
a deceased or incompetent person, to ad- 
minister the affairs of the person. 
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(ii) Public Service Employees 


Employee assistance files may indicate that 
an employee has a medical problem, but will 
not identify the problem. Health and Wel- 
fare Canada stores this information. 


The issue of treating AIDS-related personal 
information about employees has not been 
addressed by Statistics Canada. Information 
would most likely not be collected about 
employees with AIDS. The department does 
not request such information. 


If an employee volunteered information 
about AIDS to a superior, it would likely be 
treated as confidential, like any other medical 
information. 


An HIV infection "situation" has apparently 
not yet arisen at Statistics Canada. If the 
situation did arise, the department would 
look to Treasury Board policy first, but might 
develop its own policy to deal with some cir- 
cumstances. 


(iii) Non-Public Service 
Employees 


Individuals are hired for short periods under 
the authority of the Statistics Act (that is, they 
are not public servants). Typically, these per- 
sons are involved in work relating to the cen- 
sus. They are not subject to Treasury Board 
guidelines. Information about these in- 
dividuals is contained in a special bank in the 
employment register. The register does not 
contain medical information. 


External Affairs 


There are two areas where AIDS cases arise 
as a policy question: employees and families 
of employees, and Canadians living abroad 
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who fall ill abroad and become consular 
cases. External Affairs also carries out im- 
migration interviews abroad. Therefore, EIC 
AIDS policy may affect External’s dealings 
with immigrants. 


A departmental circular, "Consular Implica- 
tions of the AIDS Epidemic", states that 
"Canadian missions provide certain forms of 
facilitative assistance to Canadians who suf- 
fer illness abroad". While the department 
regularly assists travelling Canadians who en- 
counter health problems, there is no formal 
obligation to do so. 


For an External Affairs employee, falling ill 
may necessitate early return to Canada, ad- 
ministrative disruptions, and substantial 
moving costs for the employee and family. 


In some countries, as in some Canadian 
provinces, anyone who tests positive for an- 
tibodies must be reported under local law. 
Some countries require visitors to be tested 
for HIV antibodies, but diplomats are ex- 
empted from the testing. 


Health and Welfare Canada retains all 
employee (and their families’) medical files. 
Health and Welfare Canada physicians assess 
these persons to see if they are fit for 
proposed postings. Health and Welfare 
Canada simply reports fitness for certain 
postings, but does not specify the nature of 
the medical condition that may limit postings. 


AIDS-related personal information would 
appear in External Affairs files only in un- 
usual circumstances. There is generally no 
systematic collection of such information. 
Immigration files held by External Affairs, 
however, might contain medical information 
about immigrants and potential immigrants. 


SSSssSsS890M9M9NM9na9na9n9nan@nman9maa9aa9a9o9Ss//@—_ AMIS and ‘the Privacy Acct 


External Affairs AIDS policy for non- 
employees is already well in place. A policy 
for employees is also in place. Employees are 
educated and informed of developments 
about AIDS, and the department has a policy 
on handling AIDS among its employees. 


Canadian International Development 
Agency (CIDA) 


In May 1988 the Canadian Public Health As- 
sociation delivered to CIDA a document en- 
titled CIDA AIDS Policy Study. The study 
made several recommendations, among 
them the following: 


e CIDA should develop and adopt its own 
AIDS Policy Directives (APD’s) to 
manage direct-contract cooperants, 
trainees and students, and locally 
engaged staff of CIDA field offices. 
These directives would set policy and 
procedures on disseminating informa- 


tion, HIV testing, insurance require- 


Meise tie, requirement for a 
pre-departure medical examination and 
protection measures. They would also 
describe roles and responsibilities for 
managing healthy, HIV-infected and 
potentially exposed personnel; 


e Mandatory testing for HIV infection as 
a qualification for selecting or posting 
CIDA direct cooperants, dependants 
and CIDA-funded students and trainees 
is not warranted at this time; 


e CIDA should develop effective 
materials to disseminate information on 
AIDS to CIDA-funded personnel; 


e CIDA should take necessary steps to 
ensure that all development workers 
have eventual access to basic AIDS 


protection materials. For the present, 
personnel should be provided sterile 
syringes and needles. These items 
should be replaced when used from 
AIDS kits, on request from the post; 


e CIDA should monitor its adopted policy 
annually. 


In November 1988 CIDA issued Guidelines 
for Management of Technical Assistance Per- 
sonnel with AIDS and HIV Infection. The 
guidelines provide information and advice to 
project managers of CIDA and Canadian Ex- 
ecuting Agencies (CEA’s) on AIDS-related 
questions. The CIDA AIDS Protection 
Policy outlined in the guidelines applies to 
the following: 


e Canadian technical assistance personnel 
in less developed countries (these may 
be employed by or contracted by a CEA 
or a non-governmental organization; 
they may be advisors under CIDA Tech- 
nical Assistance Regulations or Foreign 
Service Directives; they may be CIDA 
consultants employed or contracted by 
multilateral agencies or clients of 
CIDA’s Industrial Cooperation 
Division) and 


e CIDA-funded students or trainees and 
eligible accompanying dependants. 


The policy does not apply to CIDA employees. 


The policy states that any information of a 
personal medical nature, including HIV in- 
fection or AIDS, is confidential. It acknow- 
ledges that the disclosure of such information 
is subject to the Privacy Act. 
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The policy states that at this time mandatory 
blood testing for the HIV antibody is not 
advisable. Nor is it a useful method of con- 
trolling HIV infection. 


CIDA does not require mandatory testing of 
Canadians destined for overseas assignment. 
However, where the countries to which in- 
dividuals are assigned require testing, CIDA 
will ensure the requirement is met. The 
policy does not specify how CIDA will ensure 
testing. Presumably, if a person refuses to be 
tested, the person will be refused the posting. 


Similarly, CIDA imposes no testing require- 
ment of its own for CIDA-funded students, 
trainees or their accompanying dependants 
entering Canada. For students or trainees 
destined for third countries, CIDA also does 
not impose mandatory testing. However, 
where a third country requires a test as a 
prerequisite for a visa, CIDA will ensure the 
requirement is met. If the person refuses 
testing, CIDA will presumably refuse access 
to the studies or training. 


Persons diagnosed as having AIDS: If clini- 
cally diagnosed as having AIDS or other con- 
ditions rendering him or her unfit to perform 
duties in the country of assignment or train- 
ing, a person will be classed as ineligible on 
medical grounds. The refusal to post 
Canadian Technical Assistance Personnel, 
where necessary, can be attributed to "medi- 
cal reasons", while the details remain con- 
fidential. 


Federal Centre for AIDS 


The only systematic collection of AIDS-re- 
lated information is the aggregate data bank 
(Health Protection Branch, Federal Centre 
for AIDS). The bank description is "timely, 
reliable, epidemiological information on 
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AIDS incidence and mortality surveillance 
programs, including epidemiological re- 
search". Its former identifier is NWC/CDC- 
165 Epidemiology. The bank description is 
as follows: 


Bank type: public. Discrete personal 
data elements will be: race, colour, 
religion, ethnic origin; age, sex, marital 
status; country of birth, citizenship 
and/or nationality. 


Purpose of the data bank is surveillance, 
and monitoring trends in disease 
progression. The proposed period of 
retention is ten years, to be reviewed in 
five years. 


The information in this bank is non-nominal 
and unlinked. Information from the provin- 
ces arrives in non-nominal form, except 
where names are needed for epidemiological 
surveillance. If the Federal Centre for AIDS 
needs additional information, it may ask 
provinces for surveillance. The resulting sur- 
veillance report does not identify individuals. 
The Federal Centre for AIDS requires 
nominal information only for specific studies. 
For example, it may perform population- 
based studies that require linkages. This is 
done only with the informed consent of those 
involved. 


Individual files are never kept systematically, 
although there may be some AIDS-related 
information contained in Health and Welfare 
Canada files. 
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